Systems and methods for multi-server quantum session authentication

- WELLS FARGO BANK, N.A.

Systems, apparatuses, methods, and computer program products are disclosed for session authentication using quantum line switching. An example system includes encoding circuitry configured to generate, based on a first set of quantum bases, a set of qbits, and transmit the first subset of qbits over a first quantum line. The encoding circuitry is configured not to transmit the first set of quantum bases. The system further includes switching circuitry configured to receive the first subset of qbits over the first quantum line, and transmit it over a second quantum line. The system further includes first decoding circuitry configured to receive the first subset of qbits, and decode, based on a second set of quantum bases, the first subset of qbits to generate a first decoded set of bits. The system further includes first session authentication circuitry configured to generate a session key based on the first decoded set of bits.

Skip to: Description  ·  Claims  ·  References Cited  · Patent History  ·  Patent History
Description
TECHNOLOGICAL FIELD

Example embodiments of the present disclosure relate generally to session authentication and, more particularly, to systems and methods for multi-server quantum session authentication.

BACKGROUND

Session authentication may describe various techniques for securing electronic communications between two computing devices, such as a server device and a client device, using a unique session key (e.g., a session identifier (ID)). Selecting a session key that cannot be guessed is thus an important element of preventing attacks whereby a perpetrator derives the session key and then uses it to intercept communications by tapping into the communication path between the server device and the client device. This security concern is amplified in high volume session authentication systems designed to authenticate multiple sessions between multiple computing devices, such as multiple server devices and multiple client devices, at any given time.

Generating session IDs to be used in session authentication often relies upon the use of pseudo-random number generation. While often referred to as “random number generation,” in truth it has historically been difficult to generate truly random numbers, and tools for “random” number generation have usually employed procedures whose outputs can be reproduced if certain underlying inputs are known. And while historically such pseudo-random number generation has been sufficient to generate session IDs that prevent malicious access, methods relying upon pseudo-random number generation are becoming increasingly susceptible to attack as the availability of computing power has increased. If a perpetrator has access to a user's device or information related to a user's session such as the user's access time, there are now often sufficient computing resources for a malicious attacker to perform a brute force attack exploiting the patterns inherent in traditional pseudo-random number generation techniques. In this way, a user's session may be compromised by an attacker who is able to replicate the user's session key. As alluded to above, this vulnerability has emerged by virtue of the new technical problems posed by the growing computing resources available today, because perpetrators have a greater ability to determine the method by which a session key is pseudo-randomly generated, replicate the method to generate the same session key, and then break into a user's session.

BRIEF SUMMARY

Systems, apparatuses, methods, and computer program products are disclosed herein for improved session authentication. The session authentication system provided herein solves the above problems by encoding and decoding quantum bits (qbits) using different sets of quantum bases in order to inject true randomness into the process for generating session keys or seeds for a pseudorandom number generation process used to establish secure sessions at multiple session servers.

In one example embodiment, a system is provided for session authentication using quantum line switching. The system comprises encoding circuitry configured to generate, based on a first set of quantum bases, a set of qbits, the set of qbits comprising a first subset of qbits. The encoding circuitry is further configured to transmit the first subset of qbits over a first quantum line, and may further be configured not to transmit the first set of quantum bases. The system comprises switching circuitry configured to receive the first subset of qbits from the encoding circuitry over the first quantum line, and transmit the first subset of qbits over a second quantum line. The system further comprises first decoding circuitry in communication with the switching circuitry, the first decoding circuitry configured to receive the first subset of qbits, and decode, based on a second set of quantum bases, the first subset of qbits to generate a first decoded set of bits. In some embodiments, the system further comprises first session authentication circuitry configured to generate a session key based on the first decoded set of bits.

In another example embodiment, an apparatus is provided for session authentication using quantum line switching. In some embodiments, the apparatus comprises switching circuitry configured to receive a set of qbits from a qbit encoder over a first quantum line, the set of qbits generated by the qbit encoder based on a first set of quantum bases, and transmit the set of qbits over a second quantum line. In some embodiments, the apparatus comprises decoding circuitry in communication with the switching circuitry, the decoding circuitry configured to receive the set of qbits over the second quantum line, wherein the first set of quantum bases is not received by the decoding circuitry. The decoding circuitry may be further configured to decode, based on a second set of quantum bases, the set of qbits to generate a decoded set of bits. In some embodiments, the apparatus comprises session authentication circuitry configured to generate a session key based on the decoded set of bits.

In another example embodiment, a method is provided for session authentication using quantum line switching. The method comprises receiving, by switching circuitry, a set of qbits from a qbit encoder over a first quantum line, the set of qbits generated by the qbit encoder based on a first set of quantum bases. The method further comprises transmitting, by the switching circuitry, the set of qbits over a second quantum line. The method further comprises receiving, by decoding circuitry in communication with the switching circuitry, the set of qbits over the second quantum line, wherein the first set of quantum bases is not received by the decoding circuitry. The method further comprises decoding, based on a second set of quantum bases, the set of qbits to generate a decoded set of bits. The method may further comprise generating, by session authentication circuitry, a session key based on the decoded set of bits.

The foregoing brief summary is provided merely for purposes of summarizing some example embodiments illustrating some aspects of the present disclosure. Accordingly, it will be appreciated that the above-described embodiments are merely examples and should not be construed to narrow the scope of the present disclosure in any way. It will be appreciated that the scope of the present disclosure encompasses many potential embodiments in addition to those summarized herein, some of which will be described in further detail below.

BRIEF DESCRIPTION OF THE FIGURES

The accompanying figures, which are not necessarily drawn to scale, illustrate embodiments and features of the present disclosure. Together with the specification, including the brief summary above and the detailed description below, the accompanying figures serve to explain the embodiments and features of the present disclosure. The components illustrated in the figures represent components that may or may not be present in various embodiments or features of the disclosure described herein. Accordingly, some embodiments or features of the present disclosure may include fewer or more components than those shown in the figures while not departing from the scope of the disclosure.

FIG. 1 illustrates a system diagram of a set of devices that may be involved in some example embodiments described herein;

FIG. 2 illustrates schematic block diagrams of example circuitry that may perform various operations in accordance with some example embodiments described herein;

FIG. 3 illustrates example sets of bits and quantum bases in accordance with some example embodiments described herein; and

FIG. 4 illustrates an example flowchart for generating and transmitting a set of qbits to multiple recipient devices, in accordance with some example embodiments described herein;

FIG. 5 illustrates an example flowchart for session authentication, in accordance with some example embodiments described herein; and

FIG. 6 illustrates another example flowchart for session authentication in accordance with some example embodiments described herein.

 DETAILED DESCRIPTION

Some embodiments of the present disclosure will now be described more fully hereinafter with reference to the accompanying figures, in which some, but not all embodiments of the disclosures are shown. Indeed, these disclosures may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will satisfy applicable legal requirements. Like numbers refer to like elements throughout.

Overview

As noted above, methods, apparatuses, systems, and computer program products are described herein that provide for session authentication. Traditionally, it has been very difficult to select or generate a robust session key or ID (i.e., a unique number that is unlikely to be guessed or deciphered by a third party). In addition, there is typically no way to prove that the session ID is unattainable by a third party perpetrator. In an attempt to transmit session IDs that are unattainable by a perpetrator, quantum key distribution (QKD) systems have been developed. In general terms, QKD systems exchange keys between two parties in a secure way that cannot be guessed. For instance, a one-time-pad quantum key exchange is impenetrable because a potential perpetrator eavesdropping on the transmission of a set of qbits representing a key will necessarily induce errors in the set of qbits due to quantum uncertainty, alerting the two parties to the attempted eavesdropping.

In contrast to these conventional QKD systems for transmitting secret keys securely, the present disclosure relates to a mechanism for generating unique keys in the first place. To do this, a session authentication system encodes and decodes a set of quantum bits (i.e., qbits) using different quantum bases in order to generate a random number used to generate a session key or a random seed (e.g., a set of bits that is randomized due to quantum effects such as the principle of quantum uncertainty) for pseudorandom number generation used to establish a secure session. When a bit is encoded into a qbit using a first quantum basis and decoded using the first quantum basis, the original bit is recreated. However, the nature of quantum uncertainty and the indeterminacy of quantum states establishes that decoding the qbit using a second quantum basis different from the first quantum basis will generate a bit that has some probability of being different than the original bit. As such, by ensuring that different quantum bases are used when encoding and decoding at least some of the set of qbits in a transmission, the session authentication system disclosed herein introduces random errors in the decoded bits based on quantum uncertainty and the indeterminacy of quantum states. These random errors can then prevent the reproduction of session keys by malicious attackers.

The present disclosure thus provides improved session authentication techniques by encoding and decoding quantum bits (qbits) using different sets of quantum bases in order to randomly generate a number that may be used to generate a session key or that may comprise a random seed for pseudorandom number generation used to establish a secure session. In one illustrative example, the present disclosure provides for encoding, by a qbit encoder (e.g., a laser device), a sequence of bits using varied quantum bases to generate a sequence of qbits. The quantum bases may comprise, for instance, the horizontal photon polarization state |0> and the vertical photon polarization state |1>. The quantum bases may alternatively or in addition comprise the left circular photon polarization state |L> and the right circular photon polarization state |R>, which are linear combinations of the vertical and horizontal photon polarization states |0> and |1>. Subsequently, the present disclosure provides for transmitting the sequence of qbits from the laser device to a qbit decoder (e.g., a second optoelectronic device such as a polarized light demodulator (PLD)). In some instances, the present disclosure provides for generating, by the qbit decoder, a sequence of random bits by decoding (e.g., measuring) the received sequence of qbits using arbitrary quantum bases that will thus not match the quantum bases used to encode the sequence of qbits, and which will thus introduce random errors in the set of decoded bits based on quantum uncertainty. The present disclosure then provides for a server device using the sequence of random bits as a random number to generate a session key or as a seed for pseudorandom number generation in session authentication.

In some embodiments, the present disclosure provides for generating a number of bits at a first device (e.g., the laser device referenced above), encoding the number of bits as quantum bits using a randomly-determined set of quantum bases, transmitting the quantum bits to a switching device, transmitting subsets of the quantum bits to multiple recipient devices (e.g., a first qbit decoder associated with a first session server and a second qbit decoder associated with a second session server) decoding (e.g., measuring) the received quantum bits at the multiple recipient devices using arbitrarily-determined sets of quantum bases, and using the decoded bits in session authentication client devices. The first device includes a qbit encoder and the recipient devices include a respective qbit decoders, such that the first device and the recipient devices can together perform the encoding and decoding functions contemplated herein. In other embodiments, the first device is connected to a separate qbit encoder while the recipient devices are connected to separate qbit decoders, such that the first device and the recipient devices do not perform the qbit encoding or decoding directly, but are in communication with the devices that do perform these functions. In yet other implementations, the first device includes the qbit encoder while the recipient devices rely upon separate qbit decoders, or the first device relies upon a separate qbit encoder while the recipient devices comprise qbit decoders. In any arrangement, it will be understood that while the qbit encoding and decoding functions may be performed by the first device and the recipient devices or by separate devices connected thereto, the recipient devices are nevertheless configured to subsequently use the sets of decoded bits for session authentication (or for any other purpose).

In some embodiments, the session authentication system generates a random number by transmitting a sequence of bits, with each bit being encoded as a quantum state. For instance, the |0> and |1> states may correspond to horizontal and vertical photon polarization states, while the |L> and |R> states may correspond to the two circular photon polarization states. Thus, each state is an indication of a bit and referred to herein as a “qbit.” In some embodiments, the session authentication system generates a session ID that is truly random based on the random number generated by the session authentication system. In some embodiments, the session authentication system uses this random number to generate a seed for pseudo-random number generation (PRNG) that is completely unknown. In some embodiments, the session authentication system generates a number (n) of qbits in different quantum bases. For instance, two different quantum bases could be the horizontal and vertical polarization states and the two circular photon polarization states, which are linear combinations of the vertical and horizontal photon polarization states. In some embodiments, the session authentication system then transmits the generated qbits from the qbit encoder to the qbit decoder over a quantum line. The qbit encoder and the qbit decoder may, as noted above, be in communication or integrated with any two computing devices involved in session ID generation, such as an encoding initiation device and a session authentication system, as shown in FIG. 1.

In some embodiments, the qbit decoder does not know the basis in which these qbits were encoded (i.e., the qbit encoder does not know if these qbits were encoded using the |0>, |1> states or the |L>, |R> states, or any other quantum states). The qbit decoder uses its own set of quantum bases to measure these states. In some instances, the bases used by the qbit decoder are sets of bases arbitrarily determined independent of the quantum bases used to encode the qbits. According to the quantum uncertainty of the states, each time the qbit decoder uses a different basis from the qbit encoder, it has a probability (e.g., a fifty percent chance) of measuring the bit that was originally encoded. As a result, presuming that at least a portion of the bit pattern generated by the qbit decoder is decoded using a different quantum basis than used during encoding, then upon decoding (e.g., measuring) the bit pattern, the resulting set of bits is inherently random and may be used as a random number for any purpose, e.g., as a session ID or a seed for PRNG. The random number cannot be reproduced by any perpetrator due to the probabilistic effects of quantum uncertainty, even if the perpetrator knows the original bits that were transmitted.

In some embodiments, the present disclosure provides for a single qbit encoder that is used in session authentication in a server farm by generating impenetrable random binary numbers unique to each recipient device, and unique each time at a single recipient device. In some instances, the qbit encoder has no networking capability and generates qbits (e.g., polarized photons) according to a computer program stored and executed internally. The qbit encoder transmits the polarized photons over a polarization-maintaining optical fiber (PM fiber). The PM fiber feeds into a polarization maintaining optical switch (PM switch) out of which several PM fibers branch out onto different recipient devices. The PM switches are programmed and controlled to transmit qbits to any of the recipient devices. Once a recipient device receives the qbits, that recipient device does not know in what basis those qbits were encoded because the quantum basis pattern used by the qbit encoder for encoding the qbits is programmed by the modulation electronics of the qbit encoder and is not known by any device or component external to itself. A recipient device is connected to the qbit encoder through one or more PM switches using PM fiber, and it includes a qbit decoder that measures the quantum bits in its own selected quantum basis (or set of quantum bases) which could be any given or random basis or set of bases. Due to inconsistency between the two sets of quantum bases at the qbit encoder and at the recipient device, the qbits measured by the recipient device are truly random. A session server then can use the binary number from measured quantum bits for session authentication. In some embodiments, the binary number may be used directly as a session ID or key. Alternatively, the session server may use the pattern as a seed in a pseudo-random number generator. Such a seed will be completely random and unknown to outsiders.

In some embodiments, the present disclosure provides for a laser device that is connected to many servers through a network of PM fibers and PM switches. Each server may comprise integrated optical receiver circuitry to receive and measure qbits. In one example implementation, an all optical PM switch may connect the laser device to sixteen servers. The connection may be modulated with fast modulation of the PM switch going to one server at a time. The laser device may also be connected through multiple PM switches via PM fiber to support a larger number of servers. For example, a laser device may be coupled to 256 servers through two layers of 1×16 PM switches.

In one illustrative example, the laser device may generate qbits using the horizontal and vertical polarization states as one quantum basis and the two circular photon polarization states (which are linear combinations of the vertical and horizontal photon polarization states) as another quantum basis. These qbits are then sent from the laser device, through the PM switch, to a server. The server may have no network communication with the laser device and, as such, may not know the quantum basis or bases in which these qbits were encoded. Accordingly, the server may use its own quantum basis (e.g., a pseudo-random quantum basis) to measure these qbits. For example, the server might measure every photon in the quantum basis of vertical and horizontal polarization state. Each time the server uses the wrong basis to measure the photon polarization state, the server has a fifty percent chance of decoding the correct bit according to the quantum uncertainty principle. Accordingly, the bit pattern that the server regenerates is inherently random and can be used as a session key. Alternatively the generated bit pattern could be used as a seed for PRNG.

In some embodiments, each server may use its own arbitrary quantum basis to decode qbits. In other embodiments, all of the servers may use the same quantum basis order or pattern. Due to quantum uncertainty, each time the quantum basis of any server is not the same as the quantum basis of the laser device, the qbit will be measured randomly at each server and thus each server will generate a different binary number. Even a single server measuring the same qbit sequence twice will generate two different binary numbers which are random in nature.

There are many advantages of these and other embodiments described herein, such as: providing a session key that has truly random elements, and, as a result, facilitating the generation of a session key that cannot be reproduced by a third party. The session key or the seed generated in this way is inherently random and is unattainable to any perpetrator due to quantum uncertainty.

Definitions

As used herein, the terms “data,” “content,” “information,” “electronic information,” “signal,” “command,” and similar terms may be used interchangeably to refer to data capable of being transmitted, received, and/or stored in accordance with embodiments of the present disclosure. Thus, use of any such terms should not be taken to limit the spirit or scope of embodiments of the present disclosure.

The term “comprising” means including but not limited to, and should be interpreted in the manner it is typically used in the patent context. Use of broader terms such as comprises, includes, and having should be understood to provide support for narrower terms such as consisting of, consisting essentially of, and comprised substantially of.

The phrases “in one embodiment,” “according to one embodiment,” and the like generally mean that the particular feature, structure, or characteristic following the phrase may be included in at least one embodiment of the present disclosure, and may be included in more than one embodiment of the present disclosure (importantly, such phrases do not necessarily refer to the same embodiment).

The word “example” is used herein to mean “serving as an example, instance, or illustration.” Any implementation described herein as “example” is not necessarily to be construed as preferred or advantageous over other implementations.

If the specification states a component or feature “may,” “can,” “could,” “should,” “would,” “preferably,” “possibly,” “typically,” “optionally,” “for example,” “often,” or “might” (or other such language) be included or have a characteristic, that particular component or feature is not required to be included or to have the characteristic. Such component or feature may be optionally included in some embodiments, or it may be excluded.

The terms “processor” and “processing circuitry” are used herein to refer to any programmable microprocessor, microcomputer or multiple processor chip or chips that can be configured by software instructions (applications) to perform a variety of functions, including the functions of the various embodiments described above. In some devices, multiple processors may be provided, such as one processor dedicated to wireless communication functions and one processor dedicated to running other applications. Software applications may be stored in the internal memory before they are accessed and loaded into the processors. The processors may include internal memory sufficient to store the application software instructions. In many devices the internal memory may be a volatile or nonvolatile memory, such as flash memory, or a mixture of both. The memory may also be located internal to another computing resource (e.g., enabling computer readable instructions to be downloaded over the Internet or another wired or wireless connection).

For the purposes of this description, a general reference to “memory” refers to memory accessible by the processors including internal memory or removable memory plugged into the device, remote memory (e.g., cloud storage), and/or memory within the processors themselves. For instance, memory may be any non-transitory computer readable medium having computer readable instructions (e.g., computer program instructions) stored thereof that are executable by a processor.

The term “computing device” is used herein to refer to any one or all of programmable logic controllers (PLCs), programmable automation controllers (PACs), industrial computers, desktop computers, personal data assistants (PDAs), laptop computers, tablet computers, smart books, palm-top computers, personal computers, smartphone, headset, smartwatch, and similar electronic devices equipped with at least a processor configured to perform the various operations described herein. Devices such as smartphones, laptop computers, tablet computers, headsets, and smartwatches are generally collectively referred to as mobile devices.

The term “server” or “server device” is used to refer to any computing device capable of functioning as a server, such as a master exchange server, web server, mail server, document server, or any other type of server. A server may be a dedicated computing device or a computing device including a server module (e.g., an application which may cause the computing device to operate as a server). A server module (e.g., server application) may be a full function server module, or a light or secondary server module (e.g., light or secondary server application) that is configured to provide synchronization services among the dynamic databases on computing devices. A light server or secondary server may be a slimmed-down version of server type functionality that can be implemented on a computing device, such as a smart phone, thereby enabling it to function as an Internet server (e.g., an enterprise e-mail server) only to the extent necessary to provide the functionality described herein.

The term “quantum basis” refers to sets of orthogonal quantum states, such as pairs of photonic polarization states. The pairs of photonic polarization states may comprise, for example, the rectilinear, diagonal, and circular photonic polarization states. The “rectilinear basis” refers to the pair of rectilinear photonic polarization states comprising the horizontal photon polarization state |0> and the vertical photon polarization state |1>. The “diagonal basis” refers to the pair of diagonal photonic polarization states comprising the diagonal photon polarization state of 45 degrees and the diagonal photon polarization state 135 degrees. The “circular basis” refers to the pair of circular photonic polarization states comprising the left circular photon polarization state |L> and the right circular photon polarization state |R>.

The term “quantum line” refers to a quantum communications path. For example, a quantum line may comprise an optical fiber, a polarization-maintaining optical fiber (PMF or PM fiber), an optical waveguide, a fiber optic cable, free space (e.g., air, vacuum), or a combination thereof. In some embodiments, a PM fiber uses birefringence to maintain the polarization states of photons. This is normally done by causing consistent asymmetries in the PM fiber. Three different PM fiber types are: panda fiber which is used in telecom; elliptical clad fiber; and bowtie fiber. Any of these three designs uses birefringence by adding asymmetries to the fiber through shapes and stresses introduced in the fiber. This causes two polarization states to have different phase velocities in the fiber. As such, an exchange of the overall energy of the two modes (polarization states) becomes practically impossible.

The terms “qbit encoder” and “qbit decoder” are used herein to refer to any devices that respectively encode or decode a qbit of information on a photon. In this regard, the qbit encoder and qbit decoder may comprise optoelectronic devices as described below.

The terms “laser device,” “optoelectronic device” and “optoelectronic component” are used herein to refer to any one or more of (including, but not limited to, combinations of): a polarized light modulator (PLM); a polarized light demodulator (PLD); a quantization circuit; a laser device, such as a diode laser, a vertical cavity surface emitting laser (VCSEL), a semiconductor laser, a fiberoptic laser, or an edge-emitting laser; a photodetector device, such as a photodetector, an array of photodetectors, or a photodetector panel; a light emitting device, such as a light emitting diode (LED), an array of LEDs, an LED panel, or an LED display; a sensing device, such as one or more sensors; any other device equipped with at least one of the materials, structures, or layers described herein; an optical component, such as an optical lens, filter, mirror, window, diffuser, prism, beam splitter, polarizer, or diffraction grating; any device configured to function as any of the foregoing devices; or any combination thereof. In one example, an optoelectronic device may include one or more photodetectors configured to measure qbits received over a quantum line. In yet another example, an optoelectronic device may include one or more LEDs. In yet another example, an optoelectronic device may include one or more laser devices. In some embodiments, a laser device could be an edge emitting laser chip. For example, a gallium arsenide based laser device may have a footprint smaller than one square millimeter and a thickness less than a few microns. In some embodiments, the laser device may use a VCSEL to generate qbits by modulating photons. In some embodiments, a polarization pulse shaper may be integrated with the laser chip on the same laser device. In some embodiments, modulating circuitry may be implemented on a board.

Having set forth a series of definitions called-upon throughout this application, an example system architecture is described below for implementing example embodiments and features of the present disclosure.

System Architecture

Methods, systems, apparatuses, and computer program products of the present disclosure may be embodied by any of a variety of devices. For example, the method, system, apparatus, and computer program product of an example embodiment may be embodied by one or more qbit encoders, qbit decoders, laser devices, switching devices, client devices, server devices, remote servers, cloud-based servers, cloud utilities, or other devices.

FIG. 1 illustrates a system diagram of a set of devices that may be involved in some example embodiments described herein. In this regard, FIG. 1 discloses an example environment 100 within which embodiments of the present disclosure may operate to authenticate sessions between devices. As illustrated, a session authentication system 102 may include one or more system devices 104 in communication with one or more databases 106. The session authentication system 102 may further comprise one or more qbit encoders 110, one or more switching devices 122, one or more qbit decoders 114A-114N, and one or more corresponding session servers 116A-116N. Each qbit encoder 110 may be connected to a switching device 122 through a quantum line 112. The one or more switching devices 122 may be connected to the one or more qbit decoders 114A-114N through one or more quantum lines 118A-118N. The one or more qbit decoders 114A-114N are, in turn, communicatively coupled to corresponding session servers 116A-116N. Each session server 116 may be in communication with one or more client devices 120A-120N through a communications network 108 or a non-network communications path. A given session server 116 may generate session IDs based on data received from a corresponding qbit decoder 114 to facilitate secure authentication of a communication session between the given session server 116 and one or more client devices 120A-120N as described in further detail below.

The session authentication system 102 may be embodied as one or more computers or computing systems as known in the art. The one or more system devices 104 may be embodied as one or more servers, remote servers, cloud-based servers (e.g., cloud utilities), processors, or any other suitable server devices, or any combination thereof. The one or more system devices 104 may receive, process, generate, and transmit data, signals, and electronic information to facilitate the operations of the session authentication system 102. The one or more session authentication system databases 106 may be embodied as one or more data storage devices, such as a Network Attached Storage (NAS) device or devices, or as one or more separate databases or servers. The one or more session authentication system databases 106 may store information accessed by the session authentication system 102 to facilitate the operations of the session authentication system 102. For example, the one or more session authentication system databases 106 may store quantum bases, control signals, device characteristics, and access credentials for modifying each qbit encoder 110, the one or more qbit decoders 114A-114N, and/or the session servers 116A-116N, and may store device characteristics and/or user account credentials for one or more of the client devices 120A-120N.

Each qbit encoder 110 may be embodied by any suitable qbit encoder, such as a laser device, as defined previously. Examples of a laser device may comprise a fiberoptic laser with a polarizing component, an edge-emitting laser, a VCSEL, a PLM, or any other suitable device. In some embodiments, the laser may generate qbits in the infrared or near-infrared range (e.g., 1550 nanometers (nm), 980 nm, 900 nm). In some embodiments, the qbit encoder 110 may include or store various data and electronic information. For example, qbit encoder 110 may include or store one or more control signals, electronic information indicative of one or more quantum bases, time-dependent qbit encoding schedules, or any combination thereof. In some embodiments, the qbit encoder 110 may include programmable firmware for receiving control signals and electronic instructions. In some embodiments, a qbit encoder 110 may be configured to encode, based on a first set of quantum bases, a first set of bits to generate a set of qbits. In this example, the qbit encoder 110 may be further configured to transmit the set of qbits to the one or more switching devices 122 over the one or more quantum lines 112. The one or more switching devices 122 may in turn be further configured to transmit the set of qbits to a corresponding qbit decoder 114 over a corresponding quantum line 118A-118N. In some such embodiments, the qbit encoder 110 may be configured to not transmit any electronic information indicative of the first set of quantum bases. For example, the qbit encoder 110 may be without network connection capability and incapable of communicating with a communications network such as one or more communications networks 108 or even with other components with the session authentication system 102. When foregoing network connection capability in this fashion, a qbit encoder 110 is incapable of transmitting the quantum basis or set of quantum bases used to generate qbits, and communications security is improved because a perpetrator may not be able to acquire that basis or those bases. In some embodiments, the first set of quantum bases is not transmitted by the qbit encoder 110.

The one or more switching devices 122 may be embodied by any suitable switching device, such as a polarization-maintaining (PM) switching device, an optical switching device, an electro-optical switching device, a microelectromechanical systems (MEMS) switching device, a PM fiber coupling, a splitter, or any other suitable device. In some embodiments, the one or more switching devices 122 may be embodied by three or more cascading switching devices. The one or more switching devices 122 may be configured to receive qbits from a qbit encoder 110 over a quantum line 112. The one or more switching devices 122 may be configured to transmit subsets of received qbits to qbit decoders 114A-114N by switching between quantum lines 118A-118N. In some embodiments, the one or more switching devices 122 may be configured to switch between quantum lines 118A-118N at a frequency greater than one megahertz (MHz). In some embodiments, the one or more switching devices 122 may be configured to switch between quantum lines 118A-118N at a frequency greater than one megahertz (MHz). In these embodiments, the session authentication system may be configured to authenticate over 100,000 sessions at the same time (or at nearly the same time). In some instances, the one or more switching devices 122 may comprise one or more PM switches that are non-mechanical, operate with all optical fast-switching components with less than 0.5 dB of loss, and have been tested over millions of PM switches without a loss in a single polarization state. In some instances, the one or more switching devices 122 may comprise one or more all-optical PM switches that use polarization maintaining couplers and PM fibers to achieve very high speed modulation with no loss of polarization state.

The one or more qbit decoders 114A-114N may be embodied by any suitable qbit decoder, such as an optoelectronic device (e.g., a PLD). In some embodiments, the one or more qbit decoders 114A-114N may include or store various data and electronic information. For example, the one or more qbit decoders 114A-114N may include or store one or more control signals, electronic information indicative of one or more quantum bases, time-dependent qbit decoding schedules, or any combination thereof. Alternatively, another component of the session authentication system 102 may store this information (e.g., database 106). The one or more qbit decoders 114A-114N are communicatively coupled to the qbit encoder 110 via a combination including quantum line 112, switching device 122, and a corresponding one of quantum lines 118A-118N. The one or more qbit decoders 114A-114N are configured to receive a set of qbits from the qbit encoder 110 via the quantum line 112, the switching device 122, and the corresponding quantum lines 118A-118N. The one or more qbit decoders 114A-114N are further configured to generate a second set of bits by decoding a received set of qbits based on a set of quantum bases different from the set of quantum bases used to encode the set of qbits. The second set of bits will thus include a random component insofar as at least one qbit has been encoded with a first quantum basis and was then decoded using a second quantum basis different from the first quantum basis. This random component is a function of the effect of quantum uncertainty introduced into the system by the use of divergent quantum bases for encoding and decoding. In some embodiments, the first set of quantum bases is not received by the one or more qbit decoders 114A-114N.

The qbit encoder 110 and the one or more qbit decoders 114A-114N may be configured to respectively encode and decode various qbits of the set of qbits based on multiple quantum bases, such as a first quantum basis, a second quantum basis different from the first quantum basis, and in some embodiments, additional quantum bases different from the first or the second quantum bases. The difference in quantum basis used for encoding and decoding of a particular qbit may thus manifest in several arrangements. For instance, a first quantum basis used for encoding of a qbit may comprise a first pair of orthogonal photonic polarization states selected at least partially from the group consisting of a pair of rectilinear photonic polarization states, a pair of diagonal photonic polarization states, and a pair of circular photonic polarization states; and a second quantum basis used for decoding of the qbit may comprise a second pair of orthogonal photonic polarization states selected at least partially from the group but that are different from the first pair of orthogonal photonic polarization states.

In some embodiments, the qbit encoder 110 and the one or more qbit decoders 114A-114N may be configured to respectively encode and decode various qbits of the set of qbits based on multiple quantum basis, such as a first quantum basis, a second quantum basis different from the first quantum basis, and also a third quantum basis different from the first or the second quantum bases. In some instances, the third quantum basis may be the same as, or different from, the first quantum basis. For example, the first quantum basis may comprise a first pair of orthogonal photonic polarization states selected at least partially from the group consisting of a pair of rectilinear photonic polarization states, a pair of diagonal photonic polarization states, and a pair of circular photonic polarization states; the second quantum basis may comprise a second pair of orthogonal photonic polarization states different from the first pair of orthogonal photonic polarization states and selected from the same group; and the third quantum basis may comprise a third pair of orthogonal photonic polarization states different from the second pair of orthogonal photonic polarization states and selected from the same group. In one illustrative example, the first quantum basis may be the rectilinear basis, the second quantum basis may be the diagonal basis, and the third quantum basis may be the rectilinear basis or the circular basis. In another illustrative example, the first quantum basis may be the rectilinear basis, the second quantum basis may be the circular basis, and the third quantum basis may be the rectilinear basis or the diagonal basis. In yet another illustrative example, the first quantum basis may be the diagonal basis, the second quantum basis may be the rectilinear basis, and the third quantum basis may be the diagonal basis or the circular basis. In yet another illustrative example, the first quantum basis may be the diagonal basis, the second quantum basis may be the circular basis, and the third quantum basis may be the rectilinear basis or the diagonal basis. In yet another illustrative example, the first quantum basis may be the circular basis, the second quantum basis may be the rectilinear basis, and the third quantum basis may be the diagonal basis or the circular basis. In yet another illustrative example, the first quantum basis may be the circular basis, the second quantum basis may be the diagonal basis, and the third quantum basis may be the rectilinear basis or the circular basis.

In some embodiments, the one or more qbit decoders 114A-114N may be configured to decode the set of qbits based on the second quantum basis, a third quantum basis different from the second quantum basis, and a fourth quantum basis different from the second quantum basis and also different from the third quantum basis. In some instances, the fourth quantum basis may be the same as, or different from, the first quantum basis. For example, the first quantum basis may comprise a pair of orthogonal photonic polarization states selected at least partially from the group consisting of a pair of rectilinear photonic polarization states, a pair of diagonal photonic polarization states, and a pair of circular photonic polarization states; the second quantum basis may comprise the pair of rectilinear photonic polarization states; the third quantum basis may comprise the pair of diagonal photonic polarization states; and the fourth quantum basis may comprise the pair of circular photonic polarization states. In one illustrative example, the first quantum basis may be the rectilinear basis, the second quantum basis may be the rectilinear basis, the third quantum basis may be the diagonal basis, and the fourth quantum basis may be the rectilinear basis or the circular basis. In another illustrative example, the first quantum basis may be the diagonal basis, the second quantum basis may be the rectilinear basis, the third quantum basis may be the diagonal basis, and the fourth quantum basis may be the rectilinear basis or the circular basis. In yet another illustrative example, the first quantum basis may be the circular basis, the second quantum basis may be the rectilinear basis, the third quantum basis may be the diagonal basis, and the fourth quantum basis may be the rectilinear basis or the circular basis.

The one or more qbit decoders 114A-114N are configured to transmit, to correspond session servers 116A-116N, the second set of bits generated by decoding the received set of qbits. This transmission may occur either via one or more communications networks 108 or via a non-network communication path (and in embodiments where a given qbit decoder 114 comprises a component of a corresponding session server 116, internal conveyance of the second set of bits may occur via an internal system bus (not shown in FIG. 1)).

In some embodiments, the one or more session servers 116A-116N may be located within a server farm. For example, session server 116A and session server 116B may be located within the walls of a building warehouse of a server farm or otherwise within a geographic footprint of the server farm. In some embodiments, the one or more qbit encoders 110 may be located within the server farm. In some embodiments, the one or more qbit encoders 110 may be located outside the server farm. For example, the one or more qbit encoders 110 may be located outside the geographic footprint of the server farm.

In one illustrative embodiment, a qbit encoder 110 may be configured to generate, based on a first set of quantum bases, a set of qbits comprising a first subset of qbits and a second subset of qbits, and transmit the set of qbits to switching device 122 over quantum line 112. In some instances, the first set of quantum bases is not transmitted by the qbit encoder 110. The switching device 122 may be in communication with the qbit encoder 110 over the quantum line 112 and configured to receive the set of qbits from the qbit encoder 110 over the first quantum line 112. The switching device 122 may be further configured to transmit the first subset of qbits to qbit decoder 114A over quantum line 118A, and transmit the second subset of qbits over to qbit decoder 114B over quantum line 118B. The qbit decoder 114A may be in communication with the switching device 122 over the quantum line 118A and configured to: receive the first subset of qbits from the switching device 122 over the quantum line 118A; decode, based on a second quantum basis different from the first quantum basis, the first subset of qbits to generate a first set of bits, wherein the first set of bits comprises a first plurality of error bits. The qbit encoder may thereafter transmit the first set of bits to a corresponding session server 116A that is configured to generate a first number based on the first set of bits and authenticate a first session based on the generated first number. The qbit decoder 114B may be in communication with the switching device 122 over the quantum line 118B and configured to: receive the second subset of qbits from the switching device 122 over the quantum line 118B; decode, based on a third quantum basis different from the first quantum basis, the second subset of qbits to generate a second set of bits. The qbit encoder 110B may thereafter transmit the first set of bits to a corresponding session server 116B that is configured to generate a second number based on the second set of bits and authenticate a second session based on the generated second number. The third quantum basis may be the same as, or different from, the second quantum basis.

Each of the one or more session servers 116A-116N may be embodied as one or more servers, remote servers, cloud-based servers (e.g., cloud utilities), processors, or any other suitable server devices, or any combination thereof. Each session server 116 may manage session authentication for one or more client devices 120A-120N. In this regard, a session server 116 may be configured to generate a number based on a set of bits received from a corresponding qbit decoder 114. In some embodiments, the generated number may comprise an entirety of the received set of bits. But in other embodiments, the generated number may comprise a fraction—but not all—of the received set of bits. In some embodiments, the generated number cannot be reproduced without the first quantum basis, the first set of bits, and the second quantum basis. But even with all of this information, the generated number cannot reliably be recreated due to the randomization introduced by the quantum effect triggered from use of divergent sets of quantum bases during encoding and decoding of the set of qbits. In some embodiments, the one or more qbit decoders 114A-114N may be configured to transmit, to other components within the session authentication system 102, electronic information indicative of the sets of quantum bases they respectively use for decoding received sets of qbits. In some embodiments, the one or more qbit decoders 114A-114N may be configured to not transmit any electronic information indicative of quantum bases to any other device.

Each of the one or more session servers 116A-116N may be configured to authenticate a session based on a generated number. In some embodiments, each of the one or more session servers 116A-116N may be configured to generate a session key based on the generated number. In some embodiments, the one or more session servers 116A-116N may be configured to generate a seed for pseudo-random number generation based on the generated number, and generate a pseudo-random number based on the seed, wherein generation of the session key is based on the pseudo-random number. In some instances, the generated number is the session key. The one or more session servers 116A-116N may thereafter use a generated session key to authenticate a session between the one or more session servers 116A-116N and the one or more client devices 120A-120N. For example, a session server 116A may generate a first session key to authenticate a session between session server 116A and client device 120A, and the session server 116B may generate a second session key to authenticate a second session between session server 116B and client device 120B. Alternatively, a single session server 116A may generate the first session key to authenticate the session between session server 116A and client device 120A, and may also generate the second session key to authenticate a session between session server 116A and client device 120B.

The one or more client devices 120A-120N may be embodied by any computing device known in the art. In some embodiments, the one or more client devices 120A-120N may comprise or be coupled to one or more laptop computers, smartphones, netbooks, tablet computers, wearable devices desktop computers, electronic workstations, kiosks, automated transaction machines (ATMs), or the like. The session authentication system 102 may receive information from, and transmit information to, the one or more client devices 120A-120N. For example, the session authentication system 102 may authenticate sessions between the one or more session servers 116A-116N and the one or more client devices 120A-120N. It will be understood that in some embodiments, the client devices 120A-120N need not themselves be client devices, but may be peripheral devices communicatively coupled to client devices.

As a foundation for some embodiments, the qbit encoder 110 may provide for determining, selecting, choosing, or identifying the first set of quantum bases for encoding bits. In one illustrative embodiment, the an example qbit decoder 114A may transmit electronic information indicative of the second quantum basis or set of quantum bases to the qbit encoder 110, and the qbit encoder 110 may receive the electronic information from the qbit decoders 114A and determine the first quantum basis or set of quantum bases (e.g., a quantum basis different than the second quantum basis; a quantum basis different than at least one of the second quantum bases if more than one quantum bases are used for decoding qbits; or a set of quantum bases that includes at least one quantum basis that is not used for decoding qbits) based on the received electronic information. In another illustrative embodiment, the example qbit decoder 114A may transmit electronic information indicative of the second quantum basis or set of quantum bases to the system device 104, the system device 104 may receive the electronic information from the qbit decoder 114A and transmit the received electronic information to the qbit encoder 110, and the qbit encoder 110 may receive the electronic information from the system device 104 and determine the first quantum basis or set of quantum bases based on the received electronic information. For example, a qbit decoder 114A may transmit electronic information indicative that it is decoding qbits based on one quantum basis (e.g., the rectilinear basis; the diagonal basis; or the circular basis). The qbit encoder 110 may receive (e.g., directly from the qbit decoder 114A or indirectly via the system device 104) that electronic information and determine to encode bits based on a quantum basis different than the quantum basis used by the qbit decoder 114A for decoding qbits. In another example, the qbit decoder 114A may transmit electronic information indicative that it is decoding qbits based on two quantum bases (e.g., the rectilinear and diagonal bases; the rectilinear and circular bases; or the diagonal and circular bases). The qbit encoder 110 may receive that electronic information and determine to encode bits based on only one of those two quantum bases used by the qbit decoder 114A for decoding qbits or based on another quantum basis different than those two quantum bases. In yet another example, the qbit decoder 114A may transmit electronic information indicative that it is decoding qbits based on three quantum bases (e.g., the rectilinear, diagonal, and circular bases), and the qbit encoder 110 may receive that electronic information and determine to encode bits based on one or two of those three quantum bases used by the qbit decoder 114A for decoding qbits.

As a foundation for some embodiments, the system device 104 may provide for generating a first control signal indicative of an instruction to encode bits based on a first quantum basis or set of quantum bases that has been selected, chosen, determined, or identified by the system device 104. In one illustrative embodiment, an example qbit decoder 114A may transmit electronic information indicative of the second quantum basis or bases to the system device 104, and the system device 104 may generate a first control signal indicative of an instruction to encode bits based on the first quantum basis or set of quantum bases (e.g., a quantum basis different than the second quantum basis; a quantum basis different than at least one of the second quantum bases if more than one quantum bases are used for decoding qbits; or a set of quantum bases that includes at least one quantum basis that is not used for decoding qbits), and transmit that first control signal to qbit encoder 110, which may encode bits based on the first quantum basis or bases indicated by the first control signal. For example, the qbit decoder 114A may transmit electronic information indicative that it is decoding qbits based on one quantum basis (e.g., the rectilinear basis; the diagonal basis; or the circular basis). The system device 104 may generate a first control signal indicative of an instruction to encode bits based on a quantum basis different than the quantum basis used by the qbit decoder 114A for decoding qbits, and transmit that first control signal to the qbit encoder 110, which may encode bits based on the first quantum basis indicated by the first control signal. In another example, the qbit decoder 114A may transmit electronic information indicative that it is decoding qbits based on two quantum bases (e.g., the rectilinear and diagonal bases; the rectilinear and circular bases; or the diagonal and circular bases). The system device 104 may receive that electronic information and generate a first control signal indicative of an instruction to encode bits based on one of those two quantum bases used by the qbit decoder 114A for decoding qbits or a quantum basis different than those two quantum bases, and transmit that first control signal to the qbit encoder 110, which may encode bits based on the first quantum basis indicated by the first control signal. In yet another example, the qbit decoder 114A may transmit electronic information indicative that it is decoding qbits based on three quantum bases (e.g., the rectilinear, diagonal, and circular bases). The system device 104 may receive that electronic information and generate a first control signal indicative of an instruction to encode bits based on one or two of those three quantum bases used by the qbit decoder 114A for decoding qbits, and transmit that first control signal to the qbit encoder 110, which may encode bits based on the first quantum basis indicated by the first control signal.

As illustrated by the above embodiments and examples, the qbit encoder 110 may thus determine a set of quantum bases to use for encoding of bits based on knowledge of the set of quantum bases that will be used by a corresponding qbit decoder 114A to decode the encoded qbits. As further illustrated by the above examples, the system device 104 may generate, based on knowledge of the second quantum basis, a first control signal indicative of an instruction to encode bits based on a first quantum basis and transmit the first quantum basis to the qbit encoder 110, such that the qbit encoder 110 itself has no knowledge of the second quantum basis. In one illustrative example, the qbit decoder 114A may decode qbits using only the rectilinear basis, and the qbit encoder 110 may encode bits using only: the diagonal basis; the circular basis; the rectilinear and diagonal bases; the rectilinear and circular bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In another illustrative example, the qbit decoder 114A may decode qbits using only the diagonal basis, and the qbit encoder 110 may encode bits using only: the rectilinear basis; the circular basis; the rectilinear and diagonal bases; the rectilinear and circular bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit decoder 114A may decode qbits using only the circular basis, and the qbit encoder 110 may encode bits using only: the rectilinear basis; the diagonal basis; the rectilinear and diagonal bases; the rectilinear and circular bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit decoder 114A may decode qbits using only the rectilinear and diagonal bases, and the qbit encoder 110 may encode bits using only: the rectilinear basis; the diagonal basis; the circular basis; the rectilinear and circular bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit decoder 114A may decode qbits using only the rectilinear and circular bases, and the qbit encoder 110 may encode bits using only: the rectilinear basis; the diagonal basis; the circular basis; the rectilinear and diagonal bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit decoder 114A may decode qbits using only the diagonal and circular bases, and the qbit encoder 110 may encode bits using only: the rectilinear basis; the diagonal basis; the circular basis; the rectilinear and diagonal bases; the rectilinear and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit decoder 114A may decode qbits using only the rectilinear, diagonal, and circular bases, and the qbit encoder 110 may encode bits using only: the rectilinear basis; the diagonal basis; the circular basis; the rectilinear and diagonal bases; the rectilinear and circular bases; or the diagonal and circular bases.

As a foundation for some embodiments, the one or more qbit decoders 114A-114N may provide for determining, selecting, choosing, or identifying their respective set of quantum bases for decoding qbits. In one illustrative embodiment, the qbit encoder 110 may transmit electronic information indicative of the first quantum basis or set of quantum bases to the corresponding qbit decoder 114A, and the qbit decoder 114A may receive the electronic information from the qbit encoder 110 and determine the second quantum basis or set of quantum bases (e.g., a quantum basis different than the first quantum basis; a quantum basis different than at least one of the first quantum bases if more than one quantum bases are used for encoding bits; or a set of quantum bases that includes at least one quantum basis that is not used for encoding bits) based on the received electronic information. In another illustrative embodiment, the qbit encoder 110 may transmit electronic information indicative of the first quantum basis or bases to the system device 104, which may receive the electronic information and transmit the received electronic information to the qbit decoder 114A, and the qbit decoder 114A may receive the electronic information from the system device 104 and determine the second quantum basis or set of quantum bases based on the received electronic information. For example, the qbit encoder 110 may transmit electronic information indicative that it is encoding bits based on one quantum basis (e.g., the rectilinear basis; the diagonal basis; or the circular basis). The corresponding qbit decoder 114A may receive (e.g., directly from the qbit encoder 110 or indirectly via the system device 104 that electronic information and determine to decode qbits received from the qbit encoder 110 based on a quantum basis or set of quantum bases different than the quantum basis or set of quantum bases used by the qbit encoder 110 for encoding qbits. In another example, the qbit encoder 110 may transmit electronic information indicative that it is encoding bits based on two quantum bases (e.g., the rectilinear and diagonal bases; the rectilinear and circular bases; or the diagonal and circular bases). The qbit decoder 114A may receive that electronic information and determine to decode qbits received from the qbit encoder 110 based on one of those two quantum bases used by the qbit encoder 110 for encoding bits or another quantum basis different than those two quantum bases. In yet another example, the qbit encoder 110 may transmit electronic information indicative that it is encoding bits based on three quantum bases (e.g., the rectilinear, diagonal, and circular bases), and the qbit decoder 114A may receive that electronic information and determine to decode qbits received from the qbit encoder 110 based on one or two of those three quantum bases used by the qbit encoder 110 for encoding bits.

As a foundation for some embodiments, the system device 104 may provide for generating a second control signal indicative of an instruction to decode qbits based on a set of quantum bases that has been selected, chosen, determined, or identified by the system device 104. In one illustrative embodiment, the qbit encoder 110 may transmit electronic information indicative of the first quantum basis or bases to the system device 104, and the system device 104 may receive the electronic information from the qbit encoder 110, generate a second control signal indicative of an instruction to decode qbits based on the second quantum basis or set of quantum bases (e.g., a quantum basis different than the first quantum basis; a quantum basis different than at least one of the first quantum bases if more than one quantum bases are used for encoding bits; or a set of quantum bases that includes at least one quantum basis that is not used for encoding bits), and transmit the generated second control signal to qbit decoder 114A, which may decode qbits based on the second quantum basis or bases indicated by the second control signal. For example, the qbit encoder 110 may transmit electronic information indicative that it is encoding bits based on one quantum basis (e.g., the rectilinear basis; the diagonal basis; or the circular basis). The system device 104 may receive that electronic information, generate a second control signal indicative of an instruction to decode qbits based on a quantum basis different than the quantum basis used by the qbit encoder 110 for encoding bits, and transmit that second control signal to the qbit decoder 114A, which may decode qbits received from the qbit encoder 110 based on the second quantum basis indicated by the second control signal. In another example, the qbit encoder 110 may transmit electronic information indicative that it is encoding bits based on two quantum bases (e.g., the rectilinear and diagonal bases; the rectilinear and circular bases; or the diagonal and circular bases). The system device 104 may receive that electronic information, generate a second control signal indicative of an instruction to decode qbits based on one of those two quantum bases used by the qbit encoder 110A for encoding bits, or a quantum basis different than those two quantum bases, and transmit that second control signal to the qbit decoder 114A, which may decode qbits received from the qbit encoder 110 based on the second quantum basis indicated by the second control signal. In yet another example, the qbit encoder 110 may transmit electronic information indicative that it is encoding bits based on three quantum bases (e.g., the rectilinear, diagonal, and circular bases). The system device 104 may receive that electronic information, generate a second control signal indicative of an instruction to decode qbits based on one or two of those three quantum bases used by the qbit encoder 110 for encoding bits, and transmit that second control signal to the qbit decoder 114A, which may decode qbits received from the qbit encoder 110 based on the second quantum basis indicated by the second control signal.

Accordingly, as illustrated by the above embodiments and examples, the qbit decoder 114A may determine the second quantum basis based on knowledge of the quantum basis, or set of quantum bases, used for encoding of the set of qbits transmitted to the qbit decoder 114A via the quantum line 112A. As further illustrated by the above embodiments and examples, the system device 104 may alternatively generate, based on knowledge of the first quantum basis, a second control signal indicative of an instruction to decode qbits based on a second quantum basis and transmit the second control signal to the qbit decoder 114A such that the qbit decoder 114A has no knowledge of the first quantum basis. In one illustrative example, the qbit encoder 110 may encode bits using only the rectilinear basis, and the qbit decoder 114A may decode qbits using only: the diagonal basis; the circular basis; the rectilinear and diagonal bases; the rectilinear and circular bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In another illustrative example, the qbit encoder 110 may encode bits using only the diagonal basis, and the qbit decoder 114A may decode qbits using only: the rectilinear basis; the circular basis; the rectilinear and diagonal bases; the rectilinear and circular bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit encoder 110 may encode bits using only the circular basis, and the qbit decoder 114A may decode qbits using only: the rectilinear basis; the diagonal basis; the rectilinear and diagonal bases; the rectilinear and circular bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit encoder 110 may encode bits using only the rectilinear and diagonal bases, and the qbit decoder 114A may decode qbits using only: the rectilinear basis; the diagonal basis; the circular basis; the rectilinear and circular bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit encoder 110 may encode bits using only the rectilinear and circular bases, and the qbit decoder 114A may decode qbits using only: the rectilinear basis; the diagonal basis; the circular basis; the rectilinear and diagonal bases; the diagonal and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit encoder 110 may encode bits using only the diagonal and circular bases, and the qbit decoder 114A may decode qbits using only: the rectilinear basis; the diagonal basis; the circular basis; the rectilinear and diagonal bases; the rectilinear and circular bases; or the rectilinear, diagonal and circular bases. In yet another illustrative example, the qbit encoder 110 may encode bits using only the rectilinear, diagonal, and circular bases, and the qbit decoder 114A may decode qbits using only: the rectilinear basis; the diagonal basis; the circular basis; the rectilinear and diagonal bases; the rectilinear and circular bases; or the diagonal and circular bases.

In some embodiments, the qbit encoder 110 may be configured to encode bits based on a time-dependent qbit encoding schedule comprising a first plurality of quantum bases respectively corresponding to a first plurality of time periods. For example, an example time-dependent qbit encoding schedule may comprise electronic information indicative of instructions to encode bits based on a rectilinear basis during a first time period (e.g., a first 10 nanoseconds), a diagonal basis during a second time period (e.g., the next 20 nanoseconds), a rectilinear basis during a third time period (e.g., the next 50 nanoseconds), and a circular basis during a fourth time period (e.g., the next 20 nanoseconds), after which the time-dependent qbit encoding schedule may repeat.

In some embodiments, the one or more qbit decoders 114A-114N may be configured to decode qbits based on a time-dependent qbit decoding schedule comprising a second plurality of quantum bases respectively corresponding to a second plurality of time periods. For example, an example time-dependent qbit decoding schedule may comprise electronic information indicative of instructions to decode qbits based on a diagonal basis during a first time period (e.g., a first 5 nanoseconds), a rectilinear basis during a second time period (e.g., the next 30 nanoseconds), and a circular basis during a third time period (e.g., the next 10 nanoseconds), after which the time-dependent qbit decoding schedule may repeat.

It will be appreciated that other patterns of quantum basis selection may be utilized as well. For instance, the qbit encoder 110 and/or the one or more qbit decoders 114A-114N may be configured to respectively encode or decode qbits based on a corresponding unit-dependent encoding or decoding schedule. For example, a unit-dependent quantum encoding schedule may comprise electronic information indicative of instructions to encode qbits based on a rectilinear basis for a first number of bits (e.g., a first 2 bits), a diagonal basis for a second number of bits (e.g., the next 5 bits), a rectilinear basis for a third number of bits (e.g., the next 3 bits), and a circular basis during for a fourth number of bits (e.g., the next 2 bits), after which the unit-dependent quantum encoding schedule may repeat. As another example, a unit-dependent quantum decoding schedule may comprise electronic information indicative of instructions to decode qbits based on a diagonal basis for a first number of bits (e.g., a first 2 bits), a rectilinear basis for a second number of bits (e.g., the next 4 bits), and a circular basis during for a third number of bits (e.g., the next 2 bits), after which the unit-dependent quantum decoding schedule may repeat. Other encoding and decoding patterns may be utilized as well without departing from the scope of the present disclosure.

It will further be appreciated that the selection of the quantum basis or set of quantum bases used by the qbit encoder 110 or any of the one or more qbit decoders 114A-114N may also be selected without knowledge of the corresponding quantum basis or set of quantum bases used by the other of the qbit encoder 110 or any of the qbit decoders 114A-114N. For instance, the system device 104 may select a set of quantum bases for use by the qbit encoder 110 using a pseudo-random selection method, and after providing it to the qbit encoder 110, both the system device 104 and the qbit encoder 110 may never thereafter transmit information about the selected set of quantum bases. In another embodiment, the qbit encoder 110 may itself select a set of quantum bases for use and may utilize that selected set of quantum bases without ever transmitting information about the selected set of quantum bases to any other device. Similarly, the system device 104 may select a set of quantum bases for use by an example qbit decoder 114A using a pseudo-random selection method, and both the system device 104 and the qbit decoder 114A may never thereafter transmit information about the selected set of quantum bases.

By way of example, in some embodiments, the selection of an appropriate set of quantum bases may utilize a frequency calculation procedure in which a selection frequency for each quantum basis may be monitored such that the likelihood that an unselected quantum basis is selected during subsequent selections is increased until an unselected quantum basis is selected. Said differently, in an instance in which a first quantum basis is initially selected, the remaining quantum bases may be weighted such that selection of these quantum bases on subsequent selections operations is more likely as compared to the first quantum basis. Once these remaining quantum bases are selected in the future, however, their corresponding weighting may decrease relative to still other unselected quantum bases. To duplicate this pseudo-random process, an intruder would need to have insight into multiple different iterations of the pseudo-random number generation process, and even then would need to deduce the weighting scheme. While a frequency calculation procedure is outlined above for selection of a set of quantum bases for the qbit encoder 110 or an example qbit decoder 114A, the present disclosure contemplates that any known pseudo-random number generation algorithm (e.g., a middle-square method, mersenne twister, inversive congruential generator, lagged Fibonacci generator, linear feedback shift register or the like) may additionally or alternatively be used to pseudo-randomly select the set of quantum bases for the qbit encoder 110 and/or any of the qbit decoders 114A-114N without departing from the scope of the disclosure.

Example Implementing Apparatus

The session authentication system 102 described with reference to FIG. 1 may be embodied by one or more computing systems, such as apparatus 200 shown in FIG. 2. As illustrated in FIG. 2, the apparatus 200 may include processing circuitry 202, memory 204, input-output circuitry 206, classical communications circuitry 208, quantum communications circuitry 210, encoding circuitry 212, decoding circuitry 214, sensor circuitry 216, quantum basis determination circuitry 218, random number generation (RNG) circuitry 220, pseudo-random number generation (PRNG) circuitry 222, session authentication circuitry 224, quantum key distribution (QKD) circuitry 226, and switching circuitry 228. The apparatus 200 may be configured to execute various operations described above with respect to FIG. 1 and below with respect to FIGS. 3-4. In some embodiments, the processing circuitry 202 (and/or co-processor or any other processing circuitry assisting or otherwise associated with the processor) may be in communication with the memory 204 via a bus for passing information among components of the apparatus. The memory 204 may be non-transitory and may include, for example, one or more volatile and/or non-volatile memories. In other words, for example, the memory may be an electronic storage device (e.g., a computer readable storage medium). The memory 204 may be configured to store information, data, content, applications, instructions, or the like, for enabling the apparatus to carry out various functions in accordance with example embodiments of the present disclosure. For example, the memory 204 may be configured to store data, control signals, electronic information, and, in some instances, encoding and decoding schedules. It will be understood that the memory 204 may be configured to store any electronic information, data, control signals, schedules, embodiments, examples, figures, techniques, processes, operations, techniques, methods, systems, apparatuses, or computer program products described herein, or any combination thereof. The memory 204 may, in this regard, host components such as one or more session authentication system databases 106, referenced in FIG. 1 and described previously.

The processing circuitry 202 may be embodied in a number of different ways and may, for example, include one or more processing devices configured to perform independently. Additionally or alternatively, the processing circuitry 202 may include one or more processors configured in tandem via a bus to enable independent execution of instructions, pipelining, and/or multithreading. The use of the term “processing circuitry” may be understood to include a single core processor, a multi-core processor, multiple processors internal to the apparatus, and/or remote or “cloud” processors.

In an example embodiment, the processing circuitry 202 may be configured to execute instructions stored in the memory 204 or otherwise accessible to the processor. Alternatively or additionally, the processor may be configured to execute hard-coded functionality. As such, whether configured by hardware or software methods, or by a combination of hardware with software, the processor may represent an entity (e.g., physically embodied in circuitry) capable of performing operations according to an embodiment of the present disclosure while configured accordingly. As another example, when the processor is embodied as an executor of software instructions, the instructions may specifically configure the processor to perform the algorithms and/or operations described herein when the instructions are executed.

In some embodiments, the apparatus 200 may include input-output circuitry 206 that may, in turn, be in communication with processing circuitry 202 to provide output to the user and, in some embodiments, to receive an indication of a user input such as a set of bits, a control signal (e.g., a control signal indicative of an instruction to encode bits or decode qbits according to a particular quantum basis or set of quantum bases), or a schedule (e.g., a time-dependent qbit encoding schedule, time-dependent qbit decoding schedule, a unit-dependent quantum encoding schedule, or a unit-dependent quantum decoding schedule) provided by a user. The input-output circuitry 206 may comprise a user interface and may include a display that may include a web user interface, a mobile application, a client device, or any other suitable hardware or software. In some embodiments, the input-output circuitry 206 may also include a keyboard, a mouse, a joystick, a touch screen, touch areas, soft keys, a microphone, a speaker, or other input-output mechanisms. The processing circuitry 202 and/or input-output circuitry 206 (which may utilize the processing circuitry 202) may be configured to control one or more functions of one or more user interface elements through computer program instructions (e.g., software, firmware) stored on a memory (e.g., memory 204). Input-output circuitry 206 is optional and, in some embodiments, the apparatus 200 may not include input-output circuitry. For example, where the apparatus 200 does not interact directly with the user, the apparatus 200 may generate electronic content for display by one or more other devices with which one or more users directly interact and classical communications circuitry 208 of the apparatus 200 may be leveraged to transmit the generated electronic content to one or more of those devices.

The classical communications circuitry 208 may be any device or circuitry embodied in either hardware or a combination of hardware and software that is configured to receive and/or transmit data from or to a network and/or any other device, circuitry, or module in communication with the apparatus 200. In this regard, the classical communications circuitry 208 may include, for example, a network interface for enabling communications with a wired or wireless communications network. For example, the classical communications circuitry 208 may include one or more network interface cards, antennae, buses, switches, routers, modems, and supporting hardware and/or software, or any other device suitable for enabling communications via a network. In some embodiments, the communication interface may include the circuitry for interacting with the antenna(s) to cause transmission of signals via the antenna(s) or to handle receipt of signals received via the antenna(s). These signals may be transmitted by the apparatus 200 using any of a number of wireless personal area network (PAN) technologies, such as Bluetooth® v1.0 through v3.0, Bluetooth Low Energy (BLE), infrared wireless (e.g., IrDA), ultra-wideband (UWB), induction wireless transmission, or any other suitable technologies. In addition, it should be understood that these signals may be transmitted using Wi-Fi, Near Field Communications (NFC), Worldwide Interoperability for Microwave Access (WiMAX) or other proximity-based communications protocols.

The quantum communications circuitry 210 may be any device or circuitry embodied in either hardware or a combination of hardware and software that is configured to receive and/or transmit qbits from or to any other device, circuitry, or module in communication with the apparatus 200. In this regard, the quantum communications circuitry 210 may include, for example, a quantum communications interface for enabling quantum communications over a quantum line (e.g., quantum lines 112A-112N in FIG. 1).

The encoding circuitry 212 includes hardware components designed or configured to generate a set of qbits based on a first set of quantum bases, such as by encoding a set of bits using a first set of quantum bases. The set of qbits may comprise a first subset of qbits and a second subset of qbits. The encoding circuitry 212 may comprise a qbit encoder, as described previously. In some embodiments, the encoding circuitry 212 may include additional hardware components designed or configured to encode bits based on a time-dependent qbit encoding schedule comprising a first plurality of quantum bases respectively corresponding to a first plurality of time periods. Similarly, the encoding circuitry 212 may include additional hardware components designed or configured to encode bits based on a unit-dependent quantum encoding schedule comprising a first plurality of quantum bases respectively corresponding to a first plurality of numbers of bits to be encoded. The additional hardware components may, for instance, comprise processing circuitry 202 to perform various computing operations and a memory 204 for storage of data or electronic information received or generated by the encoding circuitry 212. The hardware components may further utilize classical communications circuitry 208, quantum communications circuitry 210, or any suitable wired or wireless communications path to communicate with a server device (e.g., system device 104), switching circuitry 228 (e.g., one or more switching device 122), or any other suitable circuitry or device described herein.

The decoding circuitry 214 includes hardware components designed or configured to generate a set of bits by decoding the set of qbits received from encoding circuitry 212 (e.g., qbit encoder 110), the switching circuitry 228, or both. For example, the decoding circuitry 214 may generate a first set of bits by decoding the first subset of qbits received from the switching circuitry 228 based on a second set of quantum bases different from a first set of quantum bases used for encoding the set of qbits. In another example, the decoding circuitry 214 may generate a second set of bits by decoding the second subset of qbits received from the switching circuitry 228 based on a third quantum basis different from the first quantum basis. The decoding circuitry 214 may comprise a qbit decoder as described previously (e.g., qbit decoder 114A). The set of bits generated by the decoding circuitry 214 may be different from the first set of bits encoded by the encoding circuitry 212. For example, the set of bits may include one or more error bits that are not discarded. In some embodiments, when the encoding circuitry 212 uses N quantum bases for encoding bits, the decoding circuitry 214 may use N−2, N−1, N+1, N+2, etc., quantum bases for decoding the qbits. In some embodiments, when the encoding circuitry 212 uses N quantum bases for encoding bits, the decoding circuitry 214 may also use N quantum bases for decoding the qbits, where the set of quantum bases used for encoding the bits is distinct from the set of quantum bases used for decoding the qbits. In some embodiments, when the encoding circuitry 212 uses N quantum bases for encoding bits, the decoding circuitry 214 may use the same N quantum bases for decoding the qbits, so long as the sequence by which the N quantum bases are selected for decoding qbits diverges from the sequence by which the N quantum bases are selected for encoding bits. For example, in some embodiments, the decoding circuitry 214 may include additional hardware components designed or configured to decode qbits based on a time-dependent qbit decoding schedule comprising a second plurality of quantum bases respectively corresponding to a second plurality of time periods. As another example, in some embodiments, the decoding circuitry 214 may include additional hardware components designed or configured to decode qbits based on a unit-dependent quantum decoding schedule comprising a second plurality of quantum bases respectively corresponding to a second plurality of numbers of bits to be decoded. These additional hardware components comprising the decoding circuitry 214 may, for instance, comprise processing circuitry 202 to perform various computing operations and a memory 204 for storage of data or electronic information received or generated by the decoding circuitry 214. These hardware components may further comprise classical communications circuitry 208, quantum communications circuitry 210, or any suitable wired or wireless communications path to communicate with one or more session servers 116A-116N, with encoding circuitry 212, switching circuitry 228 (e.g., one or more switching device 122), or with any other suitable circuitry or device described herein. In some instances, the decoding circuitry 214 may decode the set of qbits by measuring the set of qbits using sensor circuitry 216.

The sensor circuitry 216 includes hardware components designed or configured to measure received qbits. For example, the sensor circuitry 216 may comprise one or more sensors such as photodetectors, photodiodes, cameras, or any other suitable devices or optoelectronic components. These hardware components may, for instance, utilize processing circuitry 202 to perform various computing operations and may utilize memory 204 for storage of data or electronic information received or generated by the sensor circuitry 216, and may further utilize classical communications circuitry 208, quantum communications circuitry 210, or any suitable wired or wireless communications path to communicate with a system device 104, encoding circuitry 212 (e.g., a qbit encoder 110), switching circuitry 228 (e.g., one or more switching device 122), decoding circuitry 214 (e.g., one or more qbit decoders 114A-114N), a session server (e.g., one or more session servers 116A-116N), or with any other suitable circuitry or device described herein.

The quantum basis determination circuitry 218 includes hardware components designed or configured to determine, select, choose, or identify: a first quantum basis or set of quantum bases for encoding bits; a second quantum basis or set of quantum bases for decoding qbits; a third quantum basis or set of quantum bases for decoding qbits; or a combination thereof. In some embodiments, the quantum basis determination circuitry 218 includes hardware components designed or configured to generate: a first control signal indicative of an instruction to encode bits based on a first quantum basis or set of quantum bases; a second control signal indicative of an instruction to decode qbits based on a second quantum basis or set of quantum bases; a third control signal indicative of an instruction to decode qbits based on a third quantum basis or bases; or a combination thereof. In some embodiments, the quantum basis determination circuitry 218 includes hardware components designed or configured to generate: a time-dependent qbit encoding schedule comprising a first plurality of quantum bases respectively corresponding to a first plurality of time periods; a time-dependent qbit decoding schedule comprising a second plurality of quantum bases respectively corresponding to a second plurality of time periods; a second time-dependent qbit decoding schedule comprising a third plurality of quantum bases respectively corresponding to a third plurality of time periods; or a combination thereof. In some embodiments, the quantum basis determination circuitry 218 includes hardware components designed or configured to generate: a unit-dependent quantum encoding schedule comprising a first plurality of quantum bases respectively corresponding to a first plurality of numbers of bits; a unit-dependent quantum decoding schedule comprising a second plurality of quantum bases respectively corresponding to a second plurality of numbers of bits; a second unit-dependent quantum decoding schedule comprising a third plurality of quantum bases respectively corresponding to a third plurality of numbers of bits; or a combination thereof. The set of quantum bases may be selected by the quantum basis determination circuitry 218 using a pseudo-random selection method, as described previously. Subsequently, the quantum basis determination circuitry 218 may never thereafter transmit information about the selected set of quantum bases, except as necessary for instruction of corresponding qbit encoder 110 or qbit decoder 114. The quantum basis determination circuitry 218 may, in various embodiments, be a component of a qbit encoder 110, a qbit decoder 114, or by a system device 104. In some embodiments, the session authentication system 102 may comprise multiple quantum basis determination circuitries 218, such as one embodied by qbit encoder 110, one embodied by each qbit decoder 114A-114N, or simple one that controls quantum basis determination for qbit encoder 110 and another that controls quantum basis determination for qbit decoders 114A-114N. The hardware components comprising the quantum basis determination circuitry 218 may, for instance, utilize processing circuitry 202 to perform various computing operations and may utilize memory 204 for storage of data or electronic information received or generated by the quantum basis determination circuitry 218. In some embodiments, these hardware components may further utilize classical communications circuitry 208 or any other suitable wired or wireless communications path to communicate with encoding circuitry 212 (e.g., a qbit encoder 110), switching circuitry 228 (e.g., one or more switching devices 122), decoding circuitry 214 (e.g., one or more qbit decoders 114A-114N), a session server (e.g., one or more session servers 116A-116N), or any other suitable circuitry or device described herein.

The RNG circuitry 220 includes hardware components designed or configured to generate a number based on a set of bits generated by a qbit decoder 114. For example, RNG circuitry 220 may generate a number that comprises an actual set of bits generated by a qbit decoder 114, a number that includes the set of bits in its entirety, a number that includes only “error” bits for which a quantum basis used for encoding of a qbit differs from a quantum basis used for decoding of the qbit, or any other suitable number. These hardware components may, for instance, utilize processing circuitry 202 to perform various computing operations and may utilize memory 204 for storage of data or electronic information received or generated by the RNG circuitry 220. The hardware components may further utilize classical communications circuitry 208, or any other suitable wired or wireless communications path to communicate with a qbit decoder (e.g., one or more qbit decoders 114A-114N), a session server (e.g., one or more session servers 116A-116N), or any other suitable circuitry or device described herein.

The PRNG circuitry 222 includes hardware components designed or configured to receive a seed for pseudo-random number generation based on the number generated by the RNG circuitry 220 and then generate a pseudo-random number based on the seed. These hardware components may, for instance, utilize processing circuitry 202 to perform various computing operations and may utilize memory 204 for storage of data or electronic information received or generated by the PRNG circuitry 222. The hardware components may further utilize classical communications circuitry 208, quantum communications circuitry 210, or any suitable wired or wireless communications path to communicate with a server device (e.g., a system device 104), a qbit decoder (e.g., one or more qbit decoders 114A-114N), a session server (e.g., one or more session servers 116A-116N), or any other suitable circuitry or device described herein.

The session authentication circuitry 224 includes hardware components designed or configured to generate a session ID (e.g., a session key) based on a number generated by the RNG circuitry 220, a pseudo-random number generated by the PRNG circuitry 222, or both. For example, the session authentication circuitry 224 may receive the pseudo-random number from the PRNG circuitry 222 and use the received pseudo-random number as the session key. In another example, the session authentication circuitry 224 may receive the generated number from the RNG circuitry 220 and use the generated number as the session key. In yet another example, the session authentication circuitry 224 may perform a further transformation on a number generated by the RNG circuitry 220 or a pseudo-random number generated by the PRNG circuitry 222 (e.g., a convolution of the number or pseudo-random number with an independent variable, such as an internal clock time measured by the apparatus 200), and thereafter use the result of the further transformation as the session key. Following generation of the session key, the session authentication circuitry 224 may transmit the session key to a client device (e.g., one of client devices 120A-120N), and in one such embodiment, the session authentication circuitry 224 may cause QKD circuitry 226 to perform quantum key distribution of the session key to securely transmit the session key to the appropriate client device 120. In some embodiments, the session authentication circuitry 224 includes hardware components designed or configured to subsequently authenticate a session between a session server (e.g., one of session servers 116A-116N) and the appropriate client device 120. For example, the session authentication circuitry 224 may use a generated first session key to authenticate a first session on behalf of a session server 116A and at the request of one of client devices 120A-120N. In another example, the session authentication circuitry 224 may use a generated second session key to authenticate a second session between two other devices, such as session server 116B and at the request of one of the client devices 120A-120N. The session authentication circuitry 224 may receive a key from the client device 120, and then compare the received key to the generated session key to determine if a match is found. If so, the session authentication circuitry 224 may transmit a communication to the session server 116 comprising a validation of the session key received from the client device 118. If not, then the session authentication circuitry 224 may transmit a communication to the session server 116 indicating a validation failure. The hardware components comprising the session authentication circuitry 224 may, for instance, utilize processing circuitry 202 to perform various computing operations and may utilize memory 204 for storage of data or electronic information received or generated by the session authentication circuitry 224. The hardware components may further utilize classical communications circuitry 208, or any other suitable wired or wireless communications path to communicate with a session server 116A-116N or with a client device 120A-120N, or with any other suitable circuitry or device described herein.

The QKD circuitry 226 includes hardware components designed or configured to perform quantum key distribution of a session key generated by the session authentication circuitry 224. These hardware components may, for instance, utilize processing circuitry 202 to perform various computing operations and may utilize memory 204 for storage of data or electronic information received or generated by the QKD circuitry 226. The hardware components may further utilize classical communications circuitry 208, quantum communications circuitry 210, or any other suitable wired or wireless communications path to communicate with a session server 116A-116N or with a client device (e.g., one of client devices 120A-120N) to distribute a session ID to the client device, or with any other suitable circuitry or device described herein.

The switching circuitry 228 includes hardware components designed or configured to transmit qbits received from the encoding circuitry 212 to one or more qbit decoding circuitries 214 (which may comprise one or more qbit decoders 114A-114N). For example, the switching circuitry 228 may transmit a first subset of qbits received from the encoding circuitry 212 to a first qbits received from the encoding circuitry 212 to a first decoding circuitry 214 (e.g., qbit decoder 114A). In another example, the switching circuitry 228 may transmit the second subset of qbits received from the encoding circuitry 212 to a second decoding circuitry 214 (e.g., qbit decoder 114B). These hardware components may utilize quantum communications circuitry 210 to communicate with the encoding circuitry 212 (e.g., a qbit encoder 110), another switching circuitry (e.g., one or more additional switching devices 122), decoding circuitry 214 (e.g., one or more of qbit decoders 114A-114N), or any other suitable circuitry or device described herein.

As illustrated in FIG. 2, an apparatus 250 is shown that represents an example client device (e.g., any of client devices 120A-120N). The apparatus 250 includes processing circuitry 202, memory 204, input-output circuitry 206, and classical communications circuitry 208, and may optionally include quantum communications circuitry 210 and QKD circuitry 226, as described above in connection with FIG. 2. It will be appreciated that QKD circuitry 226 is an optional component of the apparatus 250 insofar as it is only required if a session ID (e.g., session key) is distributed from the session authentication system 102 to the client device 120 via a QKD procedure (other key distribution techniques may alternatively be used). It will be understood, however, that additional components providing additional functionality may be included in the apparatus 250 without departing from the scope of the present disclosure. The apparatus 250 may be involved in execution of various operations described above with respect to FIG. 1 and below with respect to FIGS. 3-4.

Although some of these components of apparatuses 200 and 250 are described with respect to their functional capabilities, it should be understood that the particular implementations necessarily include the use of particular hardware to implement such functional capabilities. It should also be understood that certain of these components may include similar or common hardware. For example, two sets of circuitry may both leverage use of the same processor, network interface, quantum communications interface, optoelectronic components, storage medium, or the like to perform their associated functions, such that duplicate hardware is not required for each set of circuitry. It should also be appreciated that, in some embodiments, one or more of these components may include a separate processor, specially configured field programmable gate array (FPGA), application specific interface circuit (ASIC), or cloud utility to perform its corresponding functions as described herein.

The use of the term “circuitry” as used herein with respect to components of apparatuses 200 and 250 therefore includes particular hardware configured to perform the functions associated with respective circuitry described herein. Of course, while the term “circuitry” should be understood broadly to include hardware, in some embodiments, circuitry may also include software for configuring the hardware. For example, in some embodiments, “circuitry” may include processing circuitry, storage media, network interfaces, quantum communications interfaces, input-output devices, optoelectronic components, and other components. In some embodiments, other elements of apparatuses 200 and 250 may provide or supplement the functionality of particular circuitry. For example, the processing circuitry 202 may provide processing functionality, memory 204 may provide storage functionality, and classical communications circuitry 208 may provide network interface functionality, among other features.

In some embodiments, various components of the apparatuses 200 and 250 may be hosted remotely (e.g., by one or more cloud servers) and thus need not physically reside on the corresponding apparatus 200 or 250. Thus, some or all of the functionality described herein may be provided by third party circuitry. For example, a given apparatus 200 or 250 may access one or more third party circuitries via any sort of networked connection that facilitates transmission of data and electronic information between the apparatus 200 or 250 and the third party circuitries. In turn, that apparatus 200 or 250 may be in remote communication with one or more of the other components describe above as comprising the apparatus 200 or 250.

As will be appreciated, computer program instructions and/or other type of code may be loaded onto a computer, processor or other programmable apparatus's circuitry to produce a machine, such that the computer, processor, or other programmable circuitry that executes the code on the machine creates the means for implementing various functions described herein.

As described above and as will be appreciated based on this disclosure, embodiments of the present disclosure may be configured as systems, apparatuses, methods, optoelectronic devices, mobile devices, backend network devices, computer program products, other suitable devices, and combinations thereof. Accordingly, embodiments may comprise various means including entirely of hardware or any combination of software with hardware. Furthermore, embodiments may take the form of a computer program product on at least one non-transitory computer-readable storage medium having computer-readable program instructions (e.g., computer software) embodied in the storage medium. Any suitable computer-readable storage medium may be utilized including non-transitory hard disks, CD-ROMs, flash memory, optical storage devices, or magnetic storage devices.

FIG. 3 illustrates an example table 300 comprising example sets of bits and quantum bases. As shown in FIG. 3, example table 300 includes a qbit encoder (e.g., qbit encoder 110) that encodes a first set of bits (“11000110”) based on a first quantum basis (“First,” “First,” “First,” “First,” “First,” “First,” “First,” “First”) to generate a set of qbits (i.e., an eight qbit sequence) comprising a first subset of qbits (i.e., the first four qbits of the eight qbit sequence) and a second subset of qbits (i.e., the last four qbits of the eight qbit sequence). The qbit encoder transmits, via a switching device (e.g., switching device 122), the generated first subset of qbits to a first qbit decoder (e.g., qbit decoder 114A) and the generated second subset of qbits to a second qbit decoder (e.g., qbit decoder 114B). The first qbit decoder receives the first subset of qbits and uses alternative first and second quantum bases (“First,” “Second,” “First,” “Second”) to measure and thus decode the first subset of qbits. When the first qbit decoder uses the first quantum basis, the decoded bit is correct. When the first qbit decoder uses the second basis, the decoded bit is referred to herein as a “wildcard bit” that has a first probability (e.g., a fifty percent chance) of being correct and a second probability (e.g., a fifty percent chance) of being incorrect, because each state in the first basis is a linear combination of the states in the second basis. In the example illustrated in FIG. 3, the first qbit decoder generates a first set of decoded bits (“1000”) that includes two wildcard bits (i.e., the second bit “0” and the fourth bit “0”) and one error bit (i.e., the second bit “0”).

It will be understood, however, that even if the first subset of qbits were stored and decoded a second time, the 50% probability of decoding accuracy when using the “wrong” quantum basis will ensure that generating the first set of decoded bits a second time may not produce the same outcome as generating the first set of decoded bits the first time. For instance, the first qbit decoder may correctly decode the second bit, but may measure the fourth bit in error. Accordingly, even if a perpetrator were to deduce the first subset of bits (“1100”), there is no way for that perpetrator to deduce whether the first set of decoded bits in this example is correct (“1100”) or contains error bits of in the second or the fourth bit. In other words, the first set of decoded bits could be “1100”, “1101”, “1000”, or “1001,” with equal probability. Thus, the decoded set of bits may be used as a session ID or may be used as the seed for a pseudo-random number generator that generates a session ID.

A similar fact holds true regarding the second subset of qbits. In the example illustrated in FIG. 3, the second qbit decoder generates a second set of decoded bits (“0010”) that includes two wildcard bits (i.e., the second bit “0” and the fourth bit “0”) and one error bit (i.e., the second bit “0”). It will be understood, however, that even if the second subset of qbits were stored and decoded a second time, the 50% probability of decoding accuracy when using the “wrong” quantum basis will ensure that generating the second set of decoded bits a second time may not produce the same outcome as generating the second set of decoded bits the first time. For instance, the second qbit decoder may correctly decode the second bit, but may measure the fourth bit in error. Accordingly, even if a perpetrator were to deduce the second subset of bits (“0110”), there is no way for that perpetrator to deduce whether the second set of decoded bits in this example is correct (“0110”) or contains error bits of in the second or the fourth bit. In other words, the second set of decoded bits could be “0110”, “0111”, “0010”, or “0011,” with equal probability. Although an 8 qbit example is illustrated in FIG. 3, in some embodiments, a larger number of bits may be utilized (e.g., 256 bits, 1048 bits). Regardless of the number of bits used, a chance of error will remain for each bit measured using the incorrect quantum basis.

In some embodiments which are not shown in FIG. 3 for the sake of brevity, each qbit decoder may receive a set of qbits and use alternative first, second, and third quantum bases (“First,” “Second,” “Third,” “First,” “Second,” “Third,” “First,” “Second”) to measure and thus decode the set of qbits. In this situation, the generated second set of bits includes a higher likelihood of error because even fewer of the qbits will be decoded using the same quantum basis with which they were encoded. Still other sets of quantum bases used for measuring received sets of qbits may be selected, as described previously. Accordingly, the amount of randomness introduced into the decoded set of bits may be increased by increasing the mismatch between the quantum bases used for encoding and decoding of qbits.

Having described specific components of example devices and circuitries involved in various embodiments contemplated herein, example procedures for session authentication are described below in connection with FIGS. 4-6.

Example Operations for Session Authentication

Turning to FIGS. 4-6, example flowcharts 400, 500, and 600 are illustrated that contain example operations for session authentication according to an example embodiment. The operations illustrated in FIGS. 4-6 may, for example, utilize or be performed by one or more of the apparatuses shown in FIG. 1, and described in FIG. 2, such as apparatus 200, which illustrates an example session authentication system 102, or apparatus 250, which illustrates an example client device 120. The various operations described in connection with FIGS. 4-6 may be performed by or through the use of one or more of processing circuitry 202, memory 204, input-output circuitry 206, classical communications circuitry 208, quantum communications circuitry 210, encoding circuitry 212, decoding circuitry 214, sensor circuitry 216, quantum basis determination circuitry 218, RNG circuitry 220, PRNG circuitry 222, session authentication circuitry 224, QKD circuitry 226, switching circuitry 228, any other suitable circuitry, and any combination thereof.

As shown by operation 402, an apparatus 200 includes means for generating a set of qbits by encoding a first set of bits based on a first set of quantum bases. The set of qbits may comprise a first subset of qbits and a second subset of qbits. The means for generating the set of qbits may be any suitable means, such as encoding circuitry 212 (comprising, for instance, a qbit encoder 110, which may comprise, for instance, a laser device), as described with reference to FIG. 1 and FIG. 2 above. As shown in FIG. 3, the first set of bits (“11000110”) may be encoded based on a first quantum basis (“First,” “First,” “First,” “First,” “First,” “First,” “First,” “First”) to generate a set of qbits (i.e., an eight qbit sequence) comprising a first subset of qbits (i.e., the first four qbits of the eight qbit sequence) and a second subset of qbits (i.e., the last four qbits of the eight qbit sequence). It will be understood, however, that in various embodiments, the first subset of qbits and the second subset of qbits may each comprise only proper subsets of the set of qbits or may each individually comprise an entirety of the set of qbits. It will be understood that although encoding circuitry 212 encodes a first set of bits based on the first set of quantum bases, other components of the apparatus 200 may perform preliminary operations facilitating performance of operation 402. In this regard, quantum basis determination circuitry 218 may be invoked to select the first set of quantum bases. As noted previously, the quantum basis determination circuitry 218 may utilize a pseudo-random process for identifying one or more quantum bases to utilize in the first set of quantum bases. Moreover, this pseudo-random process may identify not just a set of quantum bases to use, but may also identify one or another encoding schedule (e.g., a time-based encoding schedule or a unit-based encoding schedule, or another encoding schedule altogether) governing when to use each quantum basis in the set of quantum bases for encoding of the set of bits.

As shown by operation 404, the apparatus 200 includes means for transmitting the set of qbits over a first quantum line to switching circuitry 228. The means for transmitting the set of qbits may be any suitable means, such as quantum communications circuitry 210 that comprises a component of the encoding circuitry 212 as described with reference to FIG. 2 above. The quantum line may be any suitable quantum line, such as quantum line 112 described with reference to FIG. 1. The switching circuitry 228 may be any suitable switching circuitry, which may comprise a switching device 122, as described with reference to FIG. 1.

As shown by operation 406, the apparatus 200 includes means for receiving the set of qbits over the first quantum line. The means for receiving the set of qbits may be any suitable means, such as quantum communications circuitry 210 that comprises a component of a switching circuitry 228 as described with reference to FIG. 2 previously. It will further be understood that although operations 404 and 406 are described in connection with an embodiment having a single set of switching circuitry 228, this is for ease of description only, and there may be multiple switching circuitries 228 arranged in series, such that the set of qbits is conveyed through a series of switching circuitries over a series of corresponding quantum lines.

As shown by operation 408, the apparatus 200 includes means for transmitting, by the switching circuitry, a first subset of qbits over a second quantum line to first decoding circuitry. The means for transmitting the set of qbits may be any suitable means, such as quantum communications circuitry 210 that comprises a component of a switching circuitry 228, as described with reference to FIG. 2 above. The second quantum line may be any suitable quantum line, such as quantum line 118A described with reference to FIG. 1. The first decoding circuitry may be any suitable decoding circuitry 214, such as qbit decoder 114A described with reference to FIG. 1. From operation 408, the procedure advances to operation 502, described below in connection with FIG. 5.

As shown by operation 410, the apparatus 200 includes means for transmitting, by the switching circuitry, a second subset of qbits over a third quantum line to second decoding circuitry. The means for transmitting the set of qbits may be any suitable means, such as quantum communications circuitry 210 that comprises a component of a switching circuitry 228, as described with reference to FIG. 2 above. The third quantum line may be any suitable quantum line, such as quantum line 118B described with reference to FIG. 1. The second decoding circuitry may be any suitable decoding circuitry 214, such as qbit decoder 114B described with reference to FIG. 1. From operation 410, the procedure advances to operation 602, described below in connection with FIG. 6. It will be understood that although FIG. 4 outlines a process for transmitting subsets of qbits to two different decoding circuitries, this is for ease of description only, and the procedure set forth in FIG. 4 may be used to transmit a subset of qbits to any number of decoding circuitries.

Turning next to FIG. 5, example operations are shown for session authentication based on the first subset of qbits transmitted in operation 408, as described above in connection with FIG. 4.

As shown by operation 502, the apparatus 200 includes means for receiving, by the first decoding circuitry and from the switching circuitry, the first subset of qbits over the second quantum line. The means for receiving the first subset of qbits may be any suitable means, such as quantum communications circuitry 210 that comprises a component of the first decoding circuitry. As noted previously, the first decoding circuitry may be any suitable decoding circuitry 214, such as qbit decoder 114A described with reference to FIG. 1.

As shown by operation 504, the apparatus 280 includes means for generating a second set of bits by decoding the first subset of qbits based on a second set of quantum bases. In some embodiments, this second set of quantum bases is different from the first set of quantum bases. In other embodiments, the second set of quantum bases is not different from the first set of quantum bases, but the schedule governing which quantum basis is selected for decoding of which qbit is different than the schedule governing which quantum basis was selected for encoding of which of the original set of bits. The means for generating the second set of bits may be any suitable means, such as the first decoding circuitry. By decoding the first subset of qbits based on the second set of quantum bases, the second set of bits thus has a probability of being different from corresponding bits in the first set of bits. For example, as shown in the example provided in FIG. 3, a first decoding circuitry may decode the first subset of qbits based on alternative first and second quantum bases (“First,” “Second,” “First,” “Second”) to generate the second set of bits (“1000”), which includes one error bit (i.e., the second bit “0”) when compared to the first set of bits (in the example shown in FIG. 3, the first four bits of the first set of bits are “1100”).

As shown by operation 506, apparatus 200 thereafter includes means for generating a first number based on the second set of bits. The means for generating the first number may be any suitable means, such as RNG circuitry 220 described with reference to FIG. 2. For example, the generated number may be the second set of bits (“1000”). In another example, the generated number may be a number that includes the second set of bits in its entirety (e.g., “1000001000000000”).

As shown by operation 508, the apparatus 200 further includes means for generating a first session key based on the generated first number. The means for generating the first session key may be any suitable means, such as RNG circuitry 220, PRNG circuitry 222, session authentication circuitry 224, QKD circuitry 226, or a combination thereof. For example, the PRNG circuitry 222 may be configured to use the generated first number as a seed for pseudo-random number generation, and to generate a pseudo-random number based on the seed, and then to transmit the pseudo-random number to the session authentication circuitry 224. The session authentication circuitry 224 may receive the pseudo-random number and generate the first session key based on the pseudo-random number. In some instances, session authentication circuitry 224 may receive the first number directly from RNG circuitry 220 and may generate the first session key based directly on the generated first number. In this regard, in some embodiments, the generated first number may be the session key. In other instances, the pseudo-random number may be the first session key. In still other instances, the session authentication circuitry 224 may perform a transformation on the pseudo-random number (e.g., convolution with another variable, such as time) to arrive at the first session key. In some instances, the first decoded set of bits may comprise at least one error bit, and the session authentication circuitry 224 may generate the first session key based at least in part on the at least one error bit. In some instances, the first decoded set of bits may comprise at least one wildcard bit, and the session authentication circuitry 224 may generate the first session key based at least in part on the at least one wildcard bit.

Finally, as shown by operation 510, the apparatus 200 includes means, such as communications circuitry 208 or session authentication circuitry 224, for using the generated first session key for session authentication of a client device. For instance, the apparatus 200 may include means for transmitting the generated first session key to a client device (e.g., one of client devices 120A-120N). This transmission may be controlled by a first session server (e.g., session server 116A), and may invoke QKD circuitry 226 to effect secure transmission of the first session key. As another example, the apparatus 200 may thereafter use the generated first session key to authenticate access by one or more client devices 120A-120N to a session maintained by the first session server.

It will be understood that although operations 508 and 510 are described above to illustrate practical applications of some example embodiments described herein, the first number generated in operation 506 may in other embodiments be used for a variety of additional or alternative purposes (e.g., for gaming devices, statistics, cryptography, or the like) that may not necessarily fall within the context of session authentication.

Turning next to FIG. 6, example operations are shown for session authentication based on the second subset of qbits transmitted in operation 410, as described above in connection with FIG. 4.

As shown by operation 602, the apparatus 200 includes means for receiving, by the second decoding circuitry and from the switching circuitry, the second subset of qbits over the third quantum line. The means for receiving the second subset of qbits may be any suitable means, such as quantum communications circuitry 210 that comprises a component of the second decoding circuitry. As noted previously, the second decoding circuitry may be any suitable decoding circuitry 214, such as qbit decoder 114B described with reference to FIG. 1.

As shown by operation 604, the apparatus 280 includes means for generating a third set of bits by decoding the second subset of qbits based on a third set of quantum bases. In some embodiments, this third set of quantum bases is different from the first set of quantum bases. In some such embodiments, this third set of quantum bases is also different from the second set of quantum bases. In other embodiments, the third set of quantum bases is not different from the first and/or second sets of quantum bases, but the schedule governing which quantum basis is selected for decoding of which qbit is different than the schedule governing which quantum basis was selected for encoding of which of the original set of bits. The means for generating the third set of bits may be any suitable means, such as the second decoding circuitry. By decoding the second subset of qbits based on the third set of quantum bases, the third set of bits thus have a probability of being different from the corresponding bits in the first set of bits. For example, as shown in the example provided in FIG. 3, a second decoding circuitry may decode the second subset of qbits based on alternative first and second quantum bases (“First,” “Third,” “First,” “Third”) to generate the second set of bits (“0010”), which includes one error bit (i.e., the second bit “0”) when compared to the first set of bits (in the example shown in FIG. 3, the second four bits of the first set of bits are “0110”).

As shown by operation 606, apparatus 200 thereafter includes means for generating a second number based on the third set of bits. The means for generating the second number may be any suitable means, such as RNG circuitry 220 described with reference to FIG. 2 (and in this regard, the RNG circuitry 220 used to generate the second number may be the same or different than the RNG circuitry 220 used to generate the first number, in various embodiments). For example, the generated number may be the third set of bits (“1000”). In another example, the generated number may be a number that includes the third set of bits in its entirety (e.g., “1000001000000000”).

As shown by operation 608, the apparatus 200 further includes means for generating a second session key based on the generated second number. The means for generating the second session key may be any suitable means, such as RNG circuitry 220, PRNG circuitry 222, session authentication circuitry 224, QKD circuitry 226, or a combination thereof (and these components may, in various embodiments, be the same circuitry components as used to generate the first session key, or they may be different, or some may be the same while others are different). For example, the PRNG circuitry 222 may be configured to use the generated second number as a seed for pseudo-random number generation, and to generate a pseudo-random number based on the seed, and then to transmit the pseudo-random number to the session authentication circuitry 224. The session authentication circuitry 224 may receive the pseudo-random number and generate the second session key based on the pseudo-random number. In some instances, session authentication circuitry 224 may receive the second number directly from RNG circuitry 220 and may generate the second session key based directly on the generated second number. In this regard, in some embodiments, the generated second number may be the session key. In other instances, the pseudo-random number may be the second session key. In still other instances, the session authentication circuitry 224 may perform a transformation on the pseudo-random number (e.g., convolution with another variable, such as time) to arrive at the second session key. In some instances, the second decoded set of bits may comprise at least one error bit, and the session authentication circuitry 224 may generate the second session key based at least in part on the at least one error bit. In some instances, the second decoded set of bits may comprise at least one wildcard bit, and the session authentication circuitry 224 may generate the second session key based at least in part on the at least one wildcard bit.

Finally, as shown by operation 610, the apparatus 200 includes means, such as communications circuitry 208 or session authentication circuitry 224, for using the generated second session key for session authentication of a client device. For instance, the apparatus 200 may include means for transmitting the generated second session key to a client device (e.g., one of client devices 120A-120N). This transmission may be controlled by a second session server (e.g., session server 116B), and may invoke QKD circuitry 226 to effect secure transmission of the second session key. As another example, the apparatus 200 may thereafter use the generated second session key to authenticate access by one or more client devices 120A-120N to a session maintained by the first session server.

It will be understood that although operations 608 and 610 are described above to illustrate practical applications of some example embodiments described herein, the second number generated in operation 606 may in other embodiments be used for a variety of additional or alternative purposes (e.g., for gaming devices, statistics, cryptography, or the like) that may not necessarily fall within the context of session authentication.

As noted previously, there are many advantages of these and other embodiments described herein. In all cases, however, example embodiments of the present disclosure provide wide ranging benefits stemming from the generation of numbers that have truly random elements, and which in turn facilitate many heretofore unrealized opportunities, such as the generation of session IDs that cannot be reproduced by a third party.

In some embodiments, the above-described operations may not necessarily occur in the order depicted in FIG. 4, and in some cases one or more of the operations depicted in FIG. 4 may occur substantially simultaneously, or additional steps may be involved before, after, or between any of the operations shown in FIG. 4.

FIG. 4 thus illustrates a flowchart describing the operation of various systems (e.g., session authentication system 102 described with reference to FIG. 1), apparatuses (e.g., apparatus 200 described with reference to FIG. 2 and apparatus 250 described with reference to FIG. 2), methods, and computer program products according to example embodiments contemplated herein. It will be understood that each operation of the flowchart, and combinations of operations in the flowchart, may be implemented by various means, such as hardware, firmware, processor, circuitry, and/or other devices associated with execution of software including one or more computer program instructions. For example, one or more of the procedures described above may be performed by execution of computer program instructions. In this regard, the computer program instructions that, when executed, cause performance of the procedures described above may be stored by a memory (e.g., memory 204) of an apparatus (e.g., apparatus 200) and executed by a processor (e.g., processing circuitry 202) of the apparatus. As will be appreciated, any such computer program instructions may be loaded onto a computer or other programmable apparatus (e.g., hardware) to produce a machine, such that the resulting computer or other programmable apparatus implements the functions specified in the flowchart operations. These computer program instructions may also be stored in a computer-readable memory that may direct a computer or other programmable apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture, the execution of which implements the functions specified in the flowchart operations. The computer program instructions may also be loaded onto a computer or other programmable apparatus to cause a series of operations to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions executed on the computer or other programmable apparatus provide operations for implementing the functions specified in the flowchart operations.

The flowchart operations described with reference to FIG. 4 support combinations of means for performing the specified functions and combinations of operations for performing the specified functions. It will be understood that one or more operations of the flowchart, and combinations of operations in the flowchart, can be implemented by special purpose hardware-based computer systems which perform the specified functions, or combinations of special purpose hardware and computer instructions.

CONCLUSION

While various embodiments in accordance with the principles disclosed herein have been shown and described above, modifications thereof may be made by one skilled in the art without departing from the teachings of the disclosure. The embodiments described herein are representative only and are not intended to be limiting. Many variations, combinations, and modifications are possible and are within the scope of the disclosure. Alternative embodiments that result from combining, integrating, and/or omitting features of the embodiment(s) are also within the scope of the disclosure. Accordingly, the scope of protection is not limited by the description set out above, but is defined by the claims which follow, that scope including all equivalents of the subject matter of the claims. Each and every claim is incorporated as further disclosure into the specification and the claims are embodiment(s) of the present disclosure. Furthermore, any advantages and features described above may relate to specific embodiments, but shall not limit the application of such issued claims to processes and structures accomplishing any or all of the above advantages or having any or all of the above features.

In addition, the section headings used herein are provided for consistency with the suggestions under 37 C.F.R. 1.77 or to otherwise provide organizational cues. These headings shall not limit or characterize the disclosure set out in any claims that may issue from this disclosure. For instance, a description of a technology in the “Background” is not to be construed as an admission that certain technology is prior art to any disclosure in this disclosure. Neither is the “Summary” to be considered as a limiting characterization of the disclosure set forth in issued claims. Furthermore, any reference in this disclosure to “disclosure” or “embodiment” in the singular should not be used to argue that there is only a single point of novelty in this disclosure. Multiple embodiments of the present disclosure may be set forth according to the limitations of the multiple claims issuing from this disclosure, and such claims accordingly define the disclosure, and their equivalents, that are protected thereby. In all instances, the scope of the claims shall be considered on their own merits in light of this disclosure, but should not be constrained by the headings set forth herein.

Also, techniques, systems, subsystems, and methods described and illustrated in the various embodiments as discrete or separate may be combined or integrated with other systems, modules, techniques, or methods without departing from the scope of the present disclosure. Other devices or components shown or discussed as coupled to, or in communication with, each other may be indirectly coupled through some intermediate device or component, whether electrically, mechanically, or otherwise. Other examples of changes, substitutions, and alterations are ascertainable by one skilled in the art and could be made without departing from the scope disclosed herein.

Many modifications and other embodiments of the disclosure set forth herein will come to mind to one skilled in the art to which these embodiments pertain having the benefit of teachings presented in the foregoing descriptions and the associated figures. Although the figures only show certain components of the apparatus and systems described herein, it is understood that various other components may be used in conjunction with the supply management system. Therefore, it is to be understood that the disclosure is not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. For example, the various elements or components may be combined, rearranged, or integrated in another system or certain features may be omitted or not implemented. Moreover, the steps in any method described above may not necessarily occur in the order depicted in the accompanying figures, and in some cases one or more of the steps depicted may occur substantially simultaneously, or additional steps may be involved. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

Claims

1. A system for session authentication using quantum line switching, the system comprising:

encoding circuitry configured to generate, based on a first set of quantum bases, a set of qbits, the set of qbits comprising a first subset of qbits, and transmit the first subset of qbits over a first quantum line, wherein the encoding circuitry is further configured not to transmit the first set of quantum bases;
switching circuitry configured to receive the first subset of qbits from the encoding circuitry over the first quantum line, and transmit the first subset of qbits over a second quantum line;
first decoding circuitry in communication with the switching circuitry, the first decoding circuitry configured to receive the first subset of qbits, and decode, based on a second set of quantum bases, the first subset of qbits to generate a first decoded set of bits; and
first session authentication circuitry configured to generate a session key based on the first decoded set of bits.

2. The system of claim 1,

wherein the set of qbits further comprises a second subset of qbits;
wherein the encoding circuitry is further configured to transmit the second subset of qbits over the first quantum line;
wherein the switching circuitry is further configured to receive the second subset of qbits from the encoding circuitry over the first quantum line, and transmit the second subset of qbits over a third quantum line; and
where the system further comprises: second decoding circuitry in communication with the switching circuitry over the third quantum line, the second decoding circuitry configured to receive the second subset of qbits over the third quantum line, and decode, based on a third set of quantum bases, the second subset of qbits to generate a second decoded set of bits.

3. The system of claim 1, wherein the switching circuitry comprises first switching circuitry, and wherein the system further comprises:

second switching circuitry configured to receive the first subset of qbits from the first switching circuitry over the second quantum line, and transmit the first subset of qbits to the first decoding circuitry over a fourth quantum line,
wherein the first decoding circuitry is configured to receive the first subset of qbits by receiving the first subset of qbits from the second switching circuitry and over the fourth quantum line.

4. The system of claim 1, wherein the first session authentication circuitry is configured to transmit the first session key to a client device for use in session authentication by causing quantum key distribution circuitry to perform a quantum key distribution process that transmits the first session key to the client device.

5. The system of claim 1, wherein the first decoding circuitry is configured to decode at least one qbit of the set of qbits using a quantum basis that is different from a quantum basis used to generate the at least one qbit.

6. The system of claim 1, wherein the encoding circuitry comprises first quantum basis determination circuitry configured to determine the first set of quantum bases using a pseudo-random selection method.

7. The system of claim 1, wherein the encoding circuitry is further configured to not transmit any electronic information indicative of the first set of quantum bases.

8. The system of claim 1, wherein the encoding circuitry comprises a laser device.

9. The system of claim 1, further comprising second quantum basis determination circuitry configured to determine the second set of quantum bases using a pseudo-random selection method.

10. The system of claim 1, wherein the first quantum line and the second quantum line comprise optical fiber, optical waveguides, free space, or a combination thereof.

11. The system of claim 1, wherein the second set of quantum bases is different from the first set of quantum bases.

12. The system of claim 1, wherein:

the first set of quantum bases comprises a first pair of orthogonal photonic polarization states; and
the second set of quantum bases comprises a second pair of orthogonal photonic polarization states different from the first pair of orthogonal photonic polarization states.

13. The system of claim 1, further comprising:

random number generation circuitry configured to generate a number based on the first decoded set of bits,
wherein the first session authentication circuitry is configured to generate the session key by: setting the session key equal to the generated number, or using the generated number as a seed in a pseudo-random number generation procedure, wherein an output of the pseudo-random number generation procedure comprises the first session key.

14. The system of claim 1, wherein the first decoding circuitry is further configured to:

receive a control signal indicative of an instruction to decode the set of qbits based on the second set of quantum bases, and
in response to receiving the control signal, decode the set of qbits based on the second set of quantum bases.

15. The system of claim 1,

wherein the encoding circuitry is configured to generate the set of qbits based on a time-dependent qbit encoding schedule, and
wherein the first decoding circuitry is configured to decode the first subset of qbits based on a time-dependent qbit decoding schedule.

16. The system of claim 15,

wherein the time-dependent qbit encoding schedule comprises electronic information identifying a particular quantum basis in a plurality of quantum bases for each time period in a plurality of time periods, and
wherein the encoding circuitry is configured to, in an instance in which a current time falls within a particular time period in the plurality of time periods, generate the set of qbits using a particular quantum basis identified by the time-dependent qbit encoding schedule for the particular time period.

17. The system of claim 15,

wherein the time-dependent qbit decoding schedule comprises electronic information identifying a particular quantum basis in a plurality of quantum bases for each time period in a plurality of time periods, and
wherein the first decoding circuitry is configured to, in an instance in which a current time falls within a particular time period in the plurality of time periods, decode the set of qbits using a particular quantum basis identified by the time-dependent qbit decoding schedule for the particular time period.

18. The system of claim 1, wherein the first decoded set of bits comprises at least one error bit, and wherein the first session key is generated based at least in part on the at least one error bit.

19. A method for session authentication using quantum line switching, the method comprising:

receiving, by switching circuitry, a set of qbits from a qbit encoder over a first quantum line, the set of qbits generated by the qbit encoder based on a first set of quantum bases;
transmitting, by the switching circuitry, the set of qbits over a second quantum line;
receiving, by decoding circuitry in communication with the switching circuitry, the set of qbits over the second quantum line, wherein the first set of quantum bases is not received by the decoding circuitry;
decoding, based on a second set of quantum bases, the set of qbits to generate a decoded set of bits; and
generating, by session authentication circuitry, a session key based on the decoded set of bits.

20. An apparatus for session authentication using quantum line switching, the apparatus comprising:

switching circuitry configured to receive a set of qbits from a qbit encoder over a first quantum line, the set of qbits generated by the qbit encoder based on a first set of quantum bases, and transmit the set of qbits over a second quantum line;
decoding circuitry in communication with the switching circuitry, the decoding circuitry configured to receive the set of qbits over the second quantum line, wherein the first set of quantum bases is not received by the decoding circuitry, and decode, based on a second set of quantum bases, the set of qbits to generate a decoded set of bits; and
session authentication circuitry configured to generate a session key based on the decoded set of bits.
Referenced Cited
U.S. Patent Documents
5515438 May 7, 1996 Bennett et al.
7333611 February 19, 2008 Yuen et al.
7649996 January 19, 2010 Nishioka et al.
7697693 April 13, 2010 Elliott
7787628 August 31, 2010 Kuang et al.
8332730 December 11, 2012 Harrison et al.
8693691 April 8, 2014 Jacobs
8755525 June 17, 2014 Wiseman
8855316 October 7, 2014 Wiseman et al.
9036817 May 19, 2015 Hunt
9083684 July 14, 2015 Tanizawa et al.
9184912 November 10, 2015 Harrington
9191198 November 17, 2015 Harrison et al.
9680640 June 13, 2017 Hughes et al.
9692595 June 27, 2017 Lowans et al.
10439806 October 8, 2019 Fu et al.
10540146 January 21, 2020 Vakili
10587402 March 10, 2020 Nordholt et al.
20040238813 December 2, 2004 Lidar et al.
20050036624 February 17, 2005 Kent et al.
20050249352 November 10, 2005 Choi
20060056630 March 16, 2006 Zimmer
20060263096 November 23, 2006 Dinu et al.
20070260658 November 8, 2007 Fiorentino
20080076525 March 27, 2008 Kim
20090180615 July 16, 2009 Trifonov
20130083926 April 4, 2013 Hughes et al.
20130101119 April 25, 2013 Nordholt et al.
20130101121 April 25, 2013 Nordholt et al.
20130163759 June 27, 2013 Harrison et al.
20130251145 September 26, 2013 Lowans et al.
20130315395 November 28, 2013 Jacobs
20150188701 July 2, 2015 Nordholt et al.
20150222619 August 6, 2015 Hughes et al.
20160028542 January 28, 2016 Choi
20160248586 August 25, 2016 Hughes et al.
20160328211 November 10, 2016 Nordholt et al.
20160352515 December 1, 2016 Bunandar et al.
20170214525 July 27, 2017 Zhao et al.
20170222731 August 3, 2017 Lucamarini et al.
20170324551 November 9, 2017 Ahn
20170331623 November 16, 2017 Fu et al.
20170338951 November 23, 2017 Fu et al.
20170338952 November 23, 2017 Hong
20180069698 March 8, 2018 Hong
20180198608 July 12, 2018 Nordholt et al.
20190007215 January 3, 2019 Hakuta et al.
20190020469 January 17, 2019 Dottax et al.
20190129694 May 2, 2019 Benton et al.
20190238326 August 1, 2019 Ji
20190243611 August 8, 2019 Martin et al.
20190268146 August 29, 2019 Samid
20190289006 September 19, 2019 Fang et al.
Foreign Patent Documents
107040378 August 2017 CN
2017/108539 June 2017 WO
Other references
  • Sirdhar, S. et al., Intelligent Security Framework for IoT Devices Cryptography based End-To-End security Architecture, International Conference on Inventive Systems and Control (ICISC—2017) 1-5.
  • Mohammad, Omer K. et al., Statistical Analysis for Random Bits Generation on Quantum Key Distribution, Cyber Warfare and Digital Forensic (CyberSec), 2014 Third International Conference (2014) 45-51.
  • Liu, D. et al., A Communication Model in Multilevel Security Network Using Quantum Key, Chinese Automation Congress (CAC) (2015) 915-918.
  • Hong, K. W. et al., Challenges in Quantum Key Distribution: A Review, ACM Proceeding (2016) 29-33.
  • Debuisschert, T. et al., Strenghtening Classical Symmetric Encryption with Continuous Variable Quantum Key Distribution, CLEO Technical Digest, OSA (2012), 2 pages.
  • Abubakar, M. Y. et al., Two Channel Quantum Security Modelling Focusing on Quantum Key Distribution Technique, IT Convergence and Security (ICITCS), 2015 5th International Conference (2015) 5 pages.
  • Charjan, S. et al., “Quantum Key Distribution by Exploitation Public Key Cryptography (ECC) in Resource Constrained Devices,” International Journal of Emerging Engineering Research and Technology, 3(7): 5-12, (2015).
  • Non-Final Rejection for U.S. Appl. No. 15/916,763, dated Oct. 30, 2019.
  • Non-Final Rejection for U.S. Appl. No. 16/105,294, dated Nov. 12, 2019.
  • Non-Final Rejection for U.S. Appl. No. 16/105,370, dated Nov. 8, 2019.
  • Pandya, M., “Securing Clouds—The Quantum Way,” arXiv preprint arXiv:1512.02196, 16 pages, (2015).
  • Garcia-Escartin, Juan Carlos; Chamorro-Posada, Pedro. Hidden Probe Attacks on Ultralong Fiber Laser Key Distribution Systems. IEEE Journal of Selected Topics in Quantum Electronics (vol. 24 , Issue: 3 , May-Jun. 2018). https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8219358 (Year: 2018).
  • Imany, Poolad et al. Demonstration of frequency-bin entanglement in an integrated optical microresonator. 2017 Conference on Lasers and Electro-Optics (CLEO). https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8083593 (Year: 2017).
  • Price, Alasdair B. et al. High-Speed Quantum Key Distribution with Wavelength-Division Multiplexing on Integrated Photonic Devices. 2018 Conference on Lasers and Electro-Optics (CLEO). https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber= 8426886 (Year: 2018).
  • Armanuzzaman, Md. et al. A Secure and Efficient Data Transmission Technique Using Quantum Key Distribution. 2017 4th International Conference on Networking, Systems and Security (NSysS). https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8267797 (Year: 2017).
  • Liu, Zhihao et al. Mutually Authenticated Quantum Key Distribution Based on Entanglement Swapping. 2009 Pacific-Asia Conference on Circuits, Communications and Systems. https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5232366 (Year:2009).
  • Ronczka, John. Backchanneling Quantum Bit (Qubit) 'Shuffling1: Quantum Bit (Qubit) ‘Shuffling’ as Added Security by Slipstreaming Q-Morse. 2016 3rd Asia-Pacific World Congress on Computer Science and Engineering (APWC on CSE). https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7941948 (Year: 2016).
Patent History
Patent number: 10728029
Type: Grant
Filed: Mar 9, 2018
Date of Patent: Jul 28, 2020
Assignee: WELLS FARGO BANK, N.A. (San Francisco, CA)
Inventor: Masoud Vakili (Los Altos, CA)
Primary Examiner: Theodore C Parsons
Assistant Examiner: Thomas Ho
Application Number: 15/917,150
Classifications
Current U.S. Class: Having Particular Key Generator (380/44)
International Classification: H04L 9/08 (20060101); H04L 29/06 (20060101); H04L 9/32 (20060101);